What is CVE-2026-4840?

CVE-2026-4840 is a high-severity vulnerability in Netcore Power 15ax, classified under OS Command Injection. CVSS score: 8.8/10. Published 2026-03-26.

How severe is CVE-2026-4840?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Netcore Power 15ax

CVE-2026-4840

A security flaw has been discovered in Netcore Power 15AX up to 3.0.0.6938. Affected by this issue is the function setTools of the file /bin/netis.cgi of the component Diagnostic Tool Interface. Performing a manipulation of the argument Ip…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.002 (44.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R.

Affected products

Netcore Power 15ax — versions 3.0.0.6938

Weakness classification (CWE)

References

VDB-353146 | Netcore Power 15AX Diagnostic Tool netis.cgi setTools os command injection (vdb-entry, technical-description)
VDB-353146 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, permissions-required)
Submit #776127 | Netcore POWER15AX V3.0.0.6938 Command Injection (third-party-advisory)
github.com/fakervsbln/netcore-power15ax-cve (exploit)

Frequently asked questions

What is CVE-2026-4840?: CVE-2026-4840 is a high-severity vulnerability in Netcore Power 15ax, classified under OS Command Injection. CVSS score: 8.8/10. Published 2026-03-26.
How severe is CVE-2026-4840?: High severity. CVSS v3 base score is 8.8 out of 10.