You added in a comment, that you care about breaking out of the command and not attacking netflash directly by supplying a specific malicious parameter.
The answer to this is no, you cannot break out of this construct. Bash understands that you are supplying a parameter and doesn't allow you to manipulate the statement itself. Bash would have to do an implicit string concatination at this point, which it does not do.
As you mentioned, if eval was used, exactly this kind of concatination would take place and it would be vulnerable. Without eval, it is safe.
There might of course be a vulnerability in netflash itself, that can be triggered by the supplied parameter, but I understood that this is out of scope of the question (and would require a deep dive into netflash).