CVE-2025-5146 | Netcore NBR200V2 up to 20250508 HTTP Header /usr/bin/routerd passwd_set pwd command injection

A vulnerability has been found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2 and NBR200V2 up to 20250508 and classified as critical. This vulnerability affects the function passwd_set of the file /usr/bin/routerd of the component HTTP Header Handler. The manipulation of the argument pwd leads to command injection.

This vulnerability was named CVE-2025-5146. The attack can be initiated remotely. Furthermore, there is an exploit available.