PT-2026-28204 · Unknown · Netcore Power 15Ax

Lastxuan + 1 · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-4840

Positive Technologies · (AI Summary)

CVSS v2.0

9.0

High

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Netcore Power 15AX versions up to 3.0.0.6938

Description A security flaw exists in Netcore Power 15AX up to version 3.0.0.6938. This issue involves the setTools function within the /bin/netis.cgi file of the Diagnostic Tool Interface component. Manipulation of the IpAddr argument can lead to os command injection. Remote exploitation is possible. The exploit has been publicly released. The vendor was contacted but did not respond.

Recommendations Versions prior to 3.0.0.6938 should be updated. As a temporary workaround, restrict access to the /bin/netis.cgi file. Avoid using the IpAddr argument in the setTools function until the issue is resolved.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-4840

Affected Products

Netcore Power 15Ax

References · 7

• 🔥 https://github.com/fakervsbln/netcore-power15ax-cve · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4840 · Security Note
• https://vuldb.com/?submit.776127 · Note
• https://vuldb.com/?ctiid.353146 · Note
• https://twitter.com/CveFindCom/status/2037042631658623256 · Twitter Post
• https://vuldb.com/?id.353146 · Note
• https://twitter.com/TheHackerWire/status/2037036131787956486 · Twitter Post