Remote Code Execution Vulnerability in Netcore NAP930 Backup/Restore Functionality
CVE-2026-102241

5.1MEDIUM

Key Information:

Vendor

Netcore

Status
Nap930
Vendor
CVE Published:
29 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-102241?

A critical security issue has been identified within the Netcore NAP930 product, specifically in the Backup/Restore component. The vulnerability allows for the exploitation of an unknown portion of code in the '/lib/functions/backup_common.sh' file. The flaw arises due to improper handling of the 'aes_pass' argument, which leads to the use of a hard-coded cryptographic key. This situation enables attackers to potentially initiate remote attacks, leveraging disclosed exploit techniques. Despite early notification efforts directed at the vendor regarding this vulnerability, no feedback or remediation steps have been provided.

Affected Version(s)

NAP930 0.1.241010.141410

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-102241 - Proof of Concept

References

https://vuldb.com/vuln/411140
vdb-entrytechnical-description
https://vuldb.com/vuln/411140/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-102241
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

yyycl (VulDB User)
VulDB CNA Team
.