PT-2025-22858 · Netcore · Netcore Nbr1005Gpev2+2

Ricardo123 · Published 2025-05-25 · Updated 2025-05-28 · CVE-2025-5147

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Netcore NBR1005GPEV2 versions up to 20250508 Netcore NBR200V2 versions up to 20250508 Netcore B6V2 versions up to 20250508

Description A critical issue affects the tools ping function of the file /usr/bin/network tools. The manipulation of the url argument leads to command injection. The attack may be initiated remotely.

Recommendations For Netcore NBR1005GPEV2 versions up to 20250508, consider disabling the tools ping function until a patch is available. For Netcore NBR200V2 versions up to 20250508, consider disabling the tools ping function until a patch is available. For Netcore B6V2 versions up to 20250508, consider disabling the tools ping function until a patch is available. Avoid using the url argument in the affected tools ping function until the issue is resolved.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2025-5147

Affected Products

Netcore B6V2

Netcore Nbr1005Gpev2

Netcore Nbr200V2

References · 11

• 🔥 https://github.com/Exploo0Osion/netcore_command_injection_3 · Exploit
• 🔥 https://anonymous.4open.science/r/netcore_command_injection3-54DFaW2G · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5147 · Security Note
• https://vuldb.com/?ctiid.310235 · Note
• https://t.me/cvenotify/123555 · Telegram Post
• https://vuldb.com/?id.310235 · Note
• https://vuldb.com/?submit.573682 · Note
• https://t.me/cvetracker/24596 · Telegram Post
• https://twitter.com/SecAideInfo/status/1927670332162286047 · Twitter Post
• https://twitter.com/CVEnew/status/1926606799634936240 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1926625750611828908 · Twitter Post