Command Injection Vulnerability in Netlink ICT HG323RW Router
Summary
| CVE | CVE-2026-96515 |
|---|---|
| State | PUBLISHED |
| Assigner | CERT-In |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-24 13:17:17 UTC |
| Updated | 2026-09-24 15:17:59 UTC |
| Description | This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the web management interface. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary operating system commands with root privileges resulting in complete compromise of the affected device. |
Risk And Classification
Primary CVSS: v4.0 8.6 HIGH from [email protected]
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-434 | CWE-862 | CWE-862 CWE-862 Missing Authorization | CWE-434 CWE-434 Unrestricted upload of file with dangerous type
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.6 | HIGH | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.6 | HIGH | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Netlink ICT Pvt Ltd | Netlink ICT HG323RW Router | affected Hardware Version (V3.7) and Affected Firmware (3.1.02-260228 Netlinkver) | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.cert-in.org.in/s2cMainServlet | [email protected] | www.cert-in.org.in | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This vulnerability is reported by Muhammed Safvan. (en)
Additional Advisory Data
Solutions
CNA: Upgrade Netlink ICT HG323RW Router to latest firmware version 3.1.02-260904 (Internal Build Name: HG323RW_3.7 Netlinkver) https://netlinkict.com/firmwares/