CVE-2026-4840 - Vulnerability Analysis

Overview

Netcore Power 15AX <= 3.0.0.6938 contains a command injection caused by manipulation of the "IpAddr" argument in /bin/netis.cgi setTools function, letting remote attackers execute arbitrary OS commands, exploit requires network access.

Severity & Score

Impact

Remote attackers can execute arbitrary OS commands, potentially leading to full system compromise.

Mitigation

Update to the latest version.

References

• https://vuldb.com/?ctiid.353146
• https://vuldb.com/?id.353146
• https://vuldb.com/?submit.776127
• https://github.com/fakervsbln/netcore-power15ax-cve

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 26, 2026

🔥 CVE-2026-4840: HIGH-severity OS command injection in Netcore Power 15AX (≤3.0.0.6938). No patch, public exploit out. Remote code execution possible — immediate mitigation needed! Full compromise risk. Details: https://radar.offseq.com/threat/cve-2026-4840-os-command-injection-in-netcore-powe-abf3a5bc #OffSeq #Netcore #Security #CVE20264840

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner