{"vulnerability": "cve-2026-9409", "sightings": [{"uuid": "e26177db-ff8d-4bec-81ef-5ba70d4719ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94095", "type": "seen", "source": "https://gist.github.com/ichintu/4d27b2fa4a71489307152f1f3aa025ef", "content": "This digest covers two cybersecurity updates:\n\n\u2022 **PcapSplitter Silent Packet Loss:** A bug in the PcapPlusPlus `PcapSplitter` tool caused silent data corruption and packet loss due to mishandled TCP session reuse. When filenames collided, files were opened in write mode instead of append mode, truncating output. The issue was reproduced, patched, and successfully merged.\n\n\u2022 **Netcore NBR200V2 Command Injection (CVE-2026-94095):** A critical (9.9) remote command injection vulnerability exists in the router's traceroute diagnostic feature. Exploitable via the `url` parameter, the flaw is publicly known and actively exploited, with no vendor patch or acknowledgment issued.", "creation_timestamp": "2026-09-21T04:18:48.832479Z"}, {"uuid": "2c6119ef-e3c8-4b05-870e-0e977b9223fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94096", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mvywnzzluf2x", "content": "Daily IT Security Digest \u2014 2026-09-21\nin Netcore NBR200V2 Routers**\n   Netcore NBR200V2 v1.3.241127.071246 is hit by two critical flaws: CVE-2026-94100 is a remotely exploitable buffer overflow in WAN VLAN configuration, and CVE-2026-94096 is a command injection vulnerability in", "creation_timestamp": "2026-09-21T05:06:50.681326Z"}, {"uuid": "4f6d2757-09a5-445e-99d3-938f2e30345a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94096", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvzpgm6mor2t", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-94096: A vulnerability was found in Netcore NBR200V2 1.3.241127.071246\nCVSS 9.9\nhttps://beta.vulnsea.com/cve/CVE-2026-94096\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-21T12:25:41.462087Z"}, {"uuid": "ba03a37d-bc9f-47de-a46a-a614c3324c55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94099", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117309271481222891", "content": "CVE-2026-94099 | Netcore NBR200V2 (1.3.241127.071246): CRITICAL command injection via restore.cgi (QUERY_STRING). Remote exploit, no patch, vendor silent. Isolate devices & monitor logs. https://radar.offseq.com/threat/cve-2026-94099-command-injection-in-netcore-nbr200v2-adc35b079f75e0e5 #OffSeq #Netcore #CVE202694099 #infosec", "creation_timestamp": "2026-09-21T13:30:29.345042Z"}, {"uuid": "d2fd2949-1d0d-4b16-b80d-095d8742ceb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-94099", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvzt2jhqcc2x", "content": "Netcore NBR200V2 firmware 1.3.241127.071246 faces CRITICAL remote command injection (CVE-2026-94099, CVSS 9.4). Public exploit, no patch. Isolate & monitor systems now. https://radar.offseq.com/threat/cve-2026-94099-command-injection-in-netcore-nbr200v2-adc35b079f75e0e5 #OffSeq #Netcore #Vulnerab...", "creation_timestamp": "2026-09-21T13:30:31.534657Z"}, {"uuid": "d719286d-208b-452a-9f3c-b95b557ffce4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94095", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102953", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-94095\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackSpeak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-21 10:51:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNetcore NBR200V2 traceroute command injection PoC (CVE-2026-94095); ubus JSON-RPC -> system() root RCE; for authorized testing\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-21T15:00:03.859269Z"}, {"uuid": "52197935-0ad1-49b3-b497-1c25a0b603af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94095", "type": "published-proof-of-concept", "source": "Telegram/N-PGdqpLovLlQNbFQgrQqO8zEkhxsB1txl4jHkkqUA3cCi4", "content": "", "creation_timestamp": "2026-09-22T07:00:04.198339Z"}]}