CVE-2026-94100: Netcore NBR200V2 Buffer Overflow Vulnerability

CVE-2026-94100 Overview

CVE-2026-94100 is a buffer overflow vulnerability in the Netcore NBR200V2 router running firmware version 1.3.241127.071246. The flaw resides in the wan_config_set_vlan function within /usr/bin/routerd, part of the WAN VLAN Reconfiguration component. An attacker can trigger the overflow by manipulating the vlan_wanX.ports argument. The attack is executable remotely and requires low-level privileges. A public exploit exists, and the vendor did not respond to disclosure attempts, leaving affected devices without an official fix.

Critical Impact
Remote authenticated attackers can trigger memory corruption in the routing daemon, potentially leading to arbitrary code execution or denial of service on affected Netcore NBR200V2 devices.

Affected Products

Netcore NBR200V2 firmware 1.3.241127.071246
Component: WAN VLAN Reconfiguration
Binary: /usr/bin/routerd

Discovery Timeline

2026-09-21 - CVE-2026-94100 published to NVD
2026-09-21 - Last updated in NVD database
Vendor contact - Netcore was contacted early about the disclosure but did not respond

Technical Details for CVE-2026-94100

Vulnerability Analysis

The vulnerability is classified under [CWE-119] — improper restriction of operations within the bounds of a memory buffer. The affected function wan_config_set_vlan handles WAN VLAN reconfiguration requests inside the routerd daemon. When processing the vlan_wanX.ports argument, the function fails to enforce boundary checks on the supplied value. Attacker-supplied input overflows a fixed-size destination buffer in memory.

The overflow occurs in a long-running network-facing service, which means memory corruption can influence adjacent stack or heap structures. Depending on the layout, this can lead to control-flow hijacking or process crash. A public exploit is available, lowering the barrier for attacker weaponization.

Root Cause

The root cause is missing bounds validation on the vlan_wanX.ports parameter before it is copied into an internal buffer. The routerd process trusts the length and content of client-supplied VLAN port configuration data. No length check, truncation, or safe string copy is applied prior to the copy operation.

Attack Vector

The attack is delivered over the network to the router's management interface. The attacker must have some level of authenticated access to reach the VLAN reconfiguration endpoint. Once authenticated, a crafted request that sets vlan_wanX.ports to an oversized value reaches wan_config_set_vlan and triggers the overflow. Successful exploitation can compromise the confidentiality, integrity, and availability of the device and its downstream network segments.

No verified proof-of-concept code is republished here. Refer to the VulDB CVE-2026-94100 entry and the Notion Vulnerability Report for technical write-ups.

Detection Methods for CVE-2026-94100

Indicators of Compromise

Unexpected crashes or restarts of the routerd process on Netcore NBR200V2 devices
HTTP or API requests to VLAN configuration endpoints containing oversized vlan_wanX.ports values
Unauthorized VLAN reconfiguration events in router logs
New or unexpected administrative sessions preceding VLAN configuration changes

Detection Strategies

Inspect management-plane traffic to the router for abnormally long values in VLAN configuration parameters
Baseline the expected format and length of vlan_wanX.ports and alert on deviations
Correlate authentication events with configuration-changing API calls to detect abuse of low-privileged accounts

Monitoring Recommendations

Forward router syslog and process telemetry to a central SIEM for continuous review
Monitor for repeated failed or malformed WAN VLAN configuration requests from a single source
Track outbound connections initiated by the router itself, which may indicate post-exploitation activity

How to Mitigate CVE-2026-94100

Immediate Actions Required

Restrict access to the router's management interface to trusted administrative networks only
Disable remote WAN-side administration if it is not required for operations
Rotate credentials for all router administrative accounts and enforce strong, unique passwords
Isolate affected NBR200V2 devices on a dedicated management VLAN where feasible

Patch Information

No vendor patch is available. The vendor was contacted about this disclosure but did not respond. Organizations relying on the Netcore NBR200V2 should evaluate replacement with a supported device if the vendor continues to withhold a fix. Track the VulDB Vulnerability #408029 entry for updates.

Workarounds

Place the router behind a network firewall that blocks untrusted access to the management interface
Require VPN access before any administrative session is allowed to reach the device
Remove or restrict any low-privileged accounts that can invoke VLAN configuration functions
Segment downstream networks so that a compromised router cannot pivot into sensitive infrastructure

bash

# Example firewall rule restricting router management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP