CVE-2026-101000: Netcore NBR100V2 Auth Bypass Vulnerability

CVE-2026-101000 Overview

CVE-2026-101000 is a missing authorization vulnerability in the Netcore NBR100V2 router running firmware version 1.3.240614.030928. The flaw resides in the uci.apply function defined in /usr/share/rpcd/acl.d/unauthenticated.json, part of the device's Access Control List (ACL) Handler. Attackers can manipulate the section argument to invoke configuration operations without authentication. The vulnerability is exploitable remotely across the network and requires no user interaction. The exploit has been publicly disclosed. The vendor was contacted prior to disclosure but did not respond.

Critical Impact
Unauthenticated remote attackers can tamper with router configuration through the exposed uci.apply RPC method, enabling full compromise of network settings and downstream traffic.

Affected Products

Netcore NBR100V2 router
Firmware version 1.3.240614.030928
OpenWrt-based rpcd ACL configuration (/usr/share/rpcd/acl.d/unauthenticated.json)

Discovery Timeline

2026-09-28 - CVE-2026-101000 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-101000

Vulnerability Analysis

The Netcore NBR100V2 router exposes a JSON-RPC interface backed by OpenWrt's rpcd daemon. ACL files under /usr/share/rpcd/acl.d/ describe which RPC methods are callable without authentication. The unauthenticated.json ACL incorrectly whitelists the uci.apply method, allowing anonymous callers to invoke it with arbitrary section arguments. Because uci.apply commits staged Unified Configuration Interface (UCI) changes to the live system, unauthenticated callers can influence router configuration state. This weakness is categorized under CWE-862: Missing Authorization.

Root Cause

The root cause is an overly permissive ACL definition. The unauthenticated.json file should restrict unauthenticated RPC exposure to safe, read-only operations such as session login. Instead, it lists the privileged uci.apply method, bypassing the authentication layer that rpcd would otherwise enforce. There is no secondary authorization check inside the handler to compensate for the permissive ACL.

Attack Vector

An attacker reaches the router's HTTP or ubus RPC endpoint over the network and issues an unauthenticated JSON-RPC call to uci.apply with a controlled section parameter. No credentials, prior session, or user interaction are required. Successful exploitation can commit configuration changes affecting routing, DNS, firewall rules, and administrative access. See the GitHub configuration tampering guide and the VulDB CVE-2026-101000 report for proof-of-concept walkthroughs.

No verified exploit code is reproduced here. Refer to the linked public advisories for request structure details.

Detection Methods for CVE-2026-101000

Indicators of Compromise

Unauthenticated HTTP or ubus RPC requests targeting the uci.apply method on the router management interface.
Unexpected modifications to UCI configuration files under /etc/config/ without a corresponding authenticated session in rpcd logs.
Outbound DNS or routing changes applied to the device shortly after inbound traffic from untrusted sources.

Detection Strategies

Inspect /usr/share/rpcd/acl.d/unauthenticated.json for the presence of uci.apply or other write-capable methods in the unauthenticated scope.
Monitor the router management interface for JSON-RPC calls where method equals apply and the session token is 00000000000000000000000000000000 (the anonymous session identifier).
Correlate configuration drift events with network-side packet capture on TCP ports exposing the LuCI or ubus HTTP endpoint.

Monitoring Recommendations

Enable verbose rpcd and uhttpd logging and forward syslog data to a central collector for review.
Alert on any inbound connection to the router administration port originating from the WAN interface.
Baseline the UCI configuration and alert on unauthorized changes to network, firewall, dhcp, or system sections.

How to Mitigate CVE-2026-101000

Immediate Actions Required

Block WAN-side access to the router administration interface and restrict management to trusted LAN hosts only.
Remove uci.apply and any other privileged methods from /usr/share/rpcd/acl.d/unauthenticated.json and restart rpcd.
Audit the running configuration for unauthorized changes and restore from a known-good backup if tampering is suspected.
Rotate all administrative credentials and pre-shared keys stored on the device.

Patch Information

No vendor patch is available. The vendor was contacted prior to public disclosure but did not respond, according to the VulDB vulnerability report. Operators should treat affected devices as unpatched and apply compensating controls until a firmware update is released.

Workarounds

Place the router behind an upstream firewall that blocks inbound access to the management service.
Replace the unauthenticated.json ACL with a minimal definition that exposes only session.login, then reload rpcd.
Where feasible, replace the stock firmware with a maintained OpenWrt build that enforces authenticated RPC access.

bash

# Minimal replacement for /usr/share/rpcd/acl.d/unauthenticated.json
# Restricts unauthenticated RPC exposure to session login only
cat > /usr/share/rpcd/acl.d/unauthenticated.json <<'EOF'
{
  "unauthenticated": {
    "description": "Unauthenticated access",
    "read": {
      "ubus": {
        "session": [ "login" ]
      }
    }
  }
}
EOF
/etc/init.d/rpcd restart