CVE-2026-94101: Netcore NBR200V2 Buffer Overflow Vulnerability

CVE-2026-94101 Overview

CVE-2026-94101 is a buffer overflow vulnerability in the Netcore NBR200V2 router running firmware version 1.3.241127.071246. The flaw resides in the vlan_load_form_uci function within /usr/bin/routerd. Attackers manipulate the wan_num argument to trigger memory corruption. The vulnerability is remotely exploitable and the exploit has been publicly disclosed. According to the CVE record, the vendor was contacted before disclosure but did not respond. The weakness is classified under [CWE-119] — Improper Restriction of Operations within the Bounds of a Memory Buffer.

Critical Impact
Remote attackers with low privileges can corrupt router memory through the wan_num parameter, potentially achieving arbitrary code execution on the device and pivoting into the network behind it.

Affected Products

Netcore NBR200V2 router
Firmware version 1.3.241127.071246
The routerd binary located at /usr/bin/routerd

Discovery Timeline

2026-09-21 - CVE-2026-94101 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94101

Vulnerability Analysis

The vulnerability affects the vlan_load_form_uci function inside the routerd daemon on the Netcore NBR200V2. This function loads VLAN configuration data sourced from Unified Configuration Interface (UCI) form input. The wan_num argument is copied into a fixed-size memory buffer without adequate bounds checking. Supplying an oversized wan_num value overflows the destination buffer and corrupts adjacent memory regions.

Exploitation requires network reachability to the router's administrative interface and low-level privileges. Successful memory corruption in a long-running network daemon such as routerd can lead to denial of service, control-flow hijacking, or execution of attacker-supplied payloads with the daemon's privileges. Public disclosure of the exploit lowers the barrier for opportunistic attackers to weaponize the flaw.

Root Cause

The root cause is missing input length validation on the wan_num argument before it is written into a bounded buffer inside vlan_load_form_uci. This maps to [CWE-119], where an operation reads or writes beyond the intended bounds of a memory buffer. Router firmware often stores form fields in stack or heap buffers whose sizes assume trusted, sanitized input, an assumption that fails when the parameter is attacker-controlled.

Attack Vector

The attack vector is network-based. An attacker sends a crafted request to the router's configuration handler with an oversized wan_num value. Because processing occurs inside routerd, no user interaction on the victim device is required. See the VulDB CVE-2026-94101 entry and the VulDB Vulnerability #408030 record for additional technical context.

No verified proof-of-concept code has been reproduced here. Refer to the Notion document on the NBR200V2 vulnerability for the disclosed technical details.

Detection Methods for CVE-2026-94101

Indicators of Compromise

Unexpected crashes or restarts of the routerd process on Netcore NBR200V2 devices.
HTTP or UCI form submissions containing abnormally long wan_num parameter values.
New or unexplained outbound connections from the router to untrusted hosts following a configuration request.

Detection Strategies

Inspect web management traffic to the router for POST parameters that include wan_num with lengths outside expected numeric ranges.
Correlate routerd service restarts with preceding configuration API requests to identify exploitation attempts.
Monitor for anomalous VLAN configuration changes that were not initiated by authorized administrators.

Monitoring Recommendations

Forward router syslog and crash telemetry to a centralized logging platform for retention and query.
Alert on repeated authentication attempts against the router's management interface from a single source.
Track outbound traffic patterns from the router itself, since a compromised device may beacon to attacker infrastructure.

How to Mitigate CVE-2026-94101

Immediate Actions Required

Restrict access to the router's management interface to trusted management VLANs or specific administrator IP addresses only.
Disable remote WAN-side administration if it is enabled.
Rotate administrator credentials on affected NBR200V2 devices and enforce strong, unique passwords.
Audit device configuration for unauthorized VLAN, DNS, or firewall rule changes.

Patch Information

At the time of NVD publication, no vendor patch was available. The CVE record notes that Netcore was contacted about the disclosure but did not respond. Administrators should monitor Netcore's official channels for firmware updates addressing vlan_load_form_uci in routerd and apply them promptly once released.

Workarounds

Segment the NBR200V2 onto a management network that is not reachable from untrusted user segments.
Place a filtering device in front of the router's management interface to block oversized or malformed configuration parameters.
Consider replacing the affected device with a supported model if a vendor fix is not forthcoming.

bash

# Example: restrict router management access with an upstream ACL
# Only allow the admin workstation 10.10.0.25 to reach the router's web UI on 192.0.2.1
iptables -A FORWARD -s 10.10.0.25 -d 192.0.2.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.0.2.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.0.2.1 -p tcp --dport 443 -j DROP