The restore page on a Netcore router is a command prompt, and the vendor did not answer

Monday's named clock is the Linux kernel. CISA's three exploited bugs are due today. We wrote that Saturday and followed it with four more local-root tests on Sunday. The story that showed up overnight and will not make that list is a backup button on a cheap router.

CVE-2026-94099 landed in the CVE list this morning. The product is a Netcore NBR200V2, firmware 1.3.241127.071246. The hole is in restore.cgi, the Backup Restore page. A low-privilege remote user who can reach that page can turn a query string into a system command. Scores sit around 9.4 to 9.9 depending on who you read. VulDB says a public test is out. The vendor was contacted early and, in that account, did not answer. There is no patch in the record. We are not going to walk the string. The reason it belongs on a Monday list is the word "restore."

Why the restore page keeps showing up

Last week it was Acronis on a hosting panel (CVE-2026-87886), already used, already on KEV. The lesson was the same: the tool that is supposed to save you is a computer with a login, and the login is often weaker than the file server. A router restore page is that lesson in smaller type. If the box holds a config backup, or can pull one, and the page runs as the device, a command on that page is the device.

Netcore gear shows up in small shops and some industrial closets. It is not vCenter. It is also not "too cheap to matter." Anything with a WAN IP and a default admin is a foothold. A public test plus a silent vendor is how those footholds stay open through the next quarter.

What we would do today

• Inventory Netcore NBR200V2 (and cousins) by management URL, not by "the internet works." If restore.cgi answers from anywhere but a jump host, that is the finding.
• No vendor fix means the control is network: management off the internet, Backup Restore off if you do not need it, and a plan to replace the box if the vendor stays quiet.
• Do not fetch a random "PoC" to see if you are vulnerable. The CVE record already says the test is public. That is a reason to isolate, not a lab exercise on production.
• If you run real backups (NAS, hosting panel, SaaS), finish last week's Acronis build check. This CVE is the cartoon version of that question.

Bottom line

A restore page that runs commands is not a backup feature. Forensic Five reviews what is copied, who can reach the restore, and whether the appliance that holds the copy is itself the hole. From St. Albert, Alberta. Take the router off the internet. Then go finish the kernel.