CVE-2026-78795: Netcore B11 Router Information Disclosure

CVE-2026-78795 Overview

CVE-2026-78795 is an information disclosure vulnerability affecting the Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router, firmware version v1.3.241114.024540 and earlier. A remote, unauthenticated attacker can obtain sensitive information from the device over the network. The weakness maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Because the attack vector is network-based and requires no privileges or user interaction, the issue is exploitable directly against any exposed management interface.

Critical Impact
A remote attacker can retrieve sensitive router information without authentication, enabling reconnaissance that supports credential theft, lateral movement, and follow-on compromise of the network perimeter.

Affected Products

Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router, firmware v1.3.241114.024540
All Netcore B11 firmware versions prior to v1.3.241114.024540
Deployments exposing the router management interface to untrusted networks

Discovery Timeline

2026-10-09 - CVE-2026-78795 published to the National Vulnerability Database
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-78795

Vulnerability Analysis

The Netcore B11 router exposes sensitive information to unauthenticated remote callers. According to the public disclosure on GitHub, the device returns configuration or state data that should be restricted to authenticated administrators. The confidentiality impact is high, while integrity and availability are not affected, which is consistent with a pure information-leak condition.

Successful exploitation gives attackers reconnaissance material that typically includes network topology, device identifiers, or credential-adjacent data. Such information shortens the path to full administrative control of the router and the networks behind it, particularly in retail or small-office deployments where the B11 is marketed.

Root Cause

The root cause is missing or improperly enforced access control on one or more endpoints that return sensitive data. The device responds to network requests without first validating the caller's authentication state or session, allowing any party reachable on the management interface to retrieve protected content.

Attack Vector

Exploitation requires only network reachability to the router's web or management service. The attacker sends a crafted HTTP request to the vulnerable endpoint and parses the response. No credentials, user interaction, or prior foothold are needed. Routers exposed to the internet or to untrusted LAN segments are the primary targets.

No verified proof-of-concept code is published alongside the CVE record. Readers should consult the GitHub disclosure writeup for request-level technical details.

Detection Methods for CVE-2026-78795

Indicators of Compromise

Unauthenticated HTTP requests to Netcore B11 management endpoints originating from external or untrusted source addresses
Repeated small HTTP GET requests to configuration or status paths without preceding authentication traffic
Outbound responses from the router containing configuration fields to non-administrative client addresses

Detection Strategies

Inspect web server and firewall logs on the router's management interface for requests that receive 200 OK responses without a preceding authenticated session
Baseline normal administrative source addresses and alert on management requests from any address outside that baseline
Deploy network intrusion detection signatures that match request patterns referenced in the public disclosure

Monitoring Recommendations

Forward router access and system logs to a centralized log platform for correlation with perimeter telemetry
Monitor for scanning activity against TCP ports used by the router management service across the external perimeter
Track configuration drift and unexpected read access to sensitive device files or endpoints

How to Mitigate CVE-2026-78795

Immediate Actions Required

Restrict access to the router's management interface to a trusted administrative VLAN or management network
Block inbound connections to the router's management ports from the internet at the upstream firewall
Rotate any credentials, API keys, or shared secrets that may have been exposed through the vulnerable endpoint
Review router logs for prior unauthenticated access attempts dating back to the device's deployment

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-78795. Administrators should monitor the Netcore vendor site and the B11 product site for firmware updates addressing versions after v1.3.241114.024540. Apply updated firmware as soon as the vendor publishes a fixed release.

Workarounds

Place the router behind a network segmentation boundary that permits management traffic only from designated administrator hosts
Disable remote (WAN-side) management features entirely until a patched firmware release is available
Where feasible, replace the affected device with a supported model that receives timely security updates

bash

# Example: restrict router management interface to a trusted admin subnet
# Replace 192.0.2.0/24 with your administrative network and <ROUTER_MGMT_IP> with the router address
iptables -A FORWARD -s 192.0.2.0/24 -d <ROUTER_MGMT_IP> -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d <ROUTER_MGMT_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -s 192.0.2.0/24 -d <ROUTER_MGMT_IP> -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d <ROUTER_MGMT_IP> -p tcp --dport 443 -j DROP