CVE-2026-101188: Netcore POWER13 Auth Bypass Vulnerability

CVE-2026-101188 Overview

CVE-2026-101188 is a weak password recovery vulnerability affecting the Netcore POWER13 router, version 2.0.240730.162638. The flaw resides in the routerd.passwd_set function exposed through the /ubus endpoint. Remote attackers can trigger the password reset routine without authentication, allowing them to alter router credentials over the network. The vulnerability is classified under CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). Public exploit details have been disclosed. The vendor was contacted prior to public disclosure but did not respond, meaning no official fix is available at publication time.

Critical Impact

Unauthenticated remote attackers can reset the router administrator password through the /ubus interface, leading to full device takeover and downstream network compromise.

Affected Products

• Netcore POWER13 firmware version 2.0.240730.162638
• routerd service handling passwd_set via the /ubus interface
• Deployments exposing the ubus HTTP endpoint to untrusted networks

Discovery Timeline

• 2026-09-28 - CVE-2026-101188 published to the National Vulnerability Database
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-101188

Vulnerability Analysis

The vulnerability affects the routerd.passwd_set function reachable through the router's /ubus JSON-RPC style interface. ubus is OpenWrt's inter-process communication bus, and Netcore POWER13 exposes selected object methods over HTTP. The passwd_set method is meant to change the administrator password after user authentication. In the affected firmware, the method can be invoked without valid session credentials, satisfying the conditions of [CWE-640]. An attacker who can reach the router's HTTP interface can call the method, supply a new password, and take control of the administrative account. Because the vendor did not respond to the disclosure, no patch or coordinated advisory has been issued.

Root Cause

The root cause is a missing or incorrectly enforced authentication check on the routerd.passwd_set ubus method. The password recovery path does not verify possession of the current password, an authenticated session token, or an out-of-band recovery factor before writing the new credential.

Attack Vector

Exploitation requires network access to the router's /ubus HTTP endpoint. No credentials, user interaction, or prior privileges are needed. An attacker sends a crafted ubus call invoking routerd.passwd_set with an attacker-chosen password. On success, the administrator credential is replaced and the attacker can authenticate through the standard web or SSH interface. Technical proof-of-concept details are available in the GitHub CVE Report and the VulDB entry for CVE-2026-101188.

No verified code sample is included here. Refer to the referenced advisories for request structure and payload format.

Detection Methods for CVE-2026-101188

Indicators of Compromise

• Unexpected HTTP POST requests to /ubus referencing the routerd object and passwd_set method from external or unusual source addresses.
• Administrator login failures followed by successful logins from new IP addresses shortly after /ubus traffic.
• Router configuration changes, new port forwards, or DNS overrides appearing without a corresponding change-management record.

Detection Strategies

• Inspect router HTTP access logs for ubus calls targeting sensitive routerd methods without a preceding authenticated session.
• Correlate outbound traffic from managed endpoints with router configuration or credential changes to identify suspicious sequences.
• Alert on administrator password changes on edge network devices that do not originate from a known management workstation.

Monitoring Recommendations

• Forward router syslog and HTTP access logs to a centralized analytics platform for retention and query.
• Baseline expected sources of management traffic to the router and alert on deviations.
• Monitor for lateral movement or credential reuse from internal hosts after any confirmed router compromise.

How to Mitigate CVE-2026-101188

Immediate Actions Required

• Restrict access to the router's HTTP and /ubus interfaces so they are reachable only from trusted management networks.
• Disable remote WAN-side administration on Netcore POWER13 devices running firmware 2.0.240730.162638.
• Rotate the router administrator password and audit configuration for unauthorized changes such as DNS overrides or port forwards.
• Consider replacing exposed Netcore POWER13 devices with supported hardware if the vendor continues to provide no fix.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted prior to publication and did not respond. Track the VulDB Vulnerability #411009 record for any future firmware update from Netcore.

Workarounds

• Place the router management interface behind a firewall rule that permits only administrator IP ranges.
• Terminate WAN-side HTTP exposure and require VPN access for any remote administration.
• Segment IoT and consumer-grade routers from production networks to limit downstream impact if credentials are reset by an attacker.

# Example: block external access to the ubus HTTP endpoint via iptables
iptables -A INPUT -i wan0 -p tcp --dport 80 -m string \
    --algo bm --string "/ubus" -j DROP
iptables -A INPUT -i wan0 -p tcp --dport 443 -m string \
    --algo bm --string "/ubus" -j DROP