| عنوان | Netcore NBR100V2 1.3.240614.030928 denial of service |
|---|
| الوصف | An issue was discovered in Netcore NBR100V2 firmware 1.3.240614.030928 (also fully verified on netis NR109GPE firmware 1.3.250116.082523, the vendor's overseas edition of the same product line). The auto_ac daemon (the AP-management protocol component listening on UDP and TCP port 7700, auto-started at boot via procd with respawn) derives a body length from a plaintext header field without lower-bound validation. By sending a single crafted 4-byte packet, a remote unauthenticated attacker on the same network segment causes an integer underflow whose result is passed to AES_cbc_encrypt (libcrypto 1.0.0) as a length/pointer, producing an out-of-bounds read (UDP, packet 00000004) or out-of-bounds write (TCP, packet 00000001 with the connection held ~3 seconds) and a process crash - denial of service. The attack requires no credentials and no user interaction, and can be repeated after the watchdog restarts the process.
Root cause localization: the message-processing chain in /usr/bin/auto_ac (dynamic symbol table: msg_get_rcv_base 0x411efd / msg_blob_2_msg 0x411ca5 / msg_aes_dec 0x40cddc, importing AES_cbc_encrypt). Crash sites: AES_decrypt+72 (a0=0x43fff8, end of auto_ac's static receive buffer) and CRYPTO_cbc128_decrypt+196 (s3=0xfffffffd = len-4 underflow, varying precisely with input). A stack scan at the crash recovered the return address 0x40ce37 = msg_aes_dec+0x5b, confirming the decryption wrapper as the caller feeding the unvalidated length. CWE-190 (consequences CWE-125/CWE-787). CVSS 3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), strictly LAN scope AV:A = 6.8.
Minimal PoC (Python):
import socket, time
TARGET, PORT = "192.168.1.1", 7700
# UDP single packet -> process death (OOB read)
socket.socket(socket.AF_INET, socket.SOCK_DGRAM).sendto(bytes.fromhex("00000004"), (TARGET, PORT))
# TCP single segment, hold ~3 s -> process death (OOB write)
c = socket.create_connection((TARGET, PORT), timeout=5); c.sendall(bytes.fromhex("00000001")); time.sleep(3); c.close()
Verified on both products (fresh process per case): kill-udp and kill-tcp terminate the target with a single packet; the negative control (three benign length-16 packets of identical shape) leaves the target unaffected. The affected firmwares are the latest and only versions distributed on the vendor's official channels; no patch exists as of 2026-10-07. Vendor website: https://www.netcoretec.com ; affected firmware reference: https://www.netcoretec.com/service-support/download/firmware/2706.html
Coordinated disclosure: reported to CNVD (China National Vulnerability Database) on 2026-10-07 (CNVD IDs pending), which coordinates vendor notification. |
|---|
| المصدر | ⚠️ https://www.netcoretec.com/service-support/download/firmware/2706.html |
|---|
| المستخدم | xuanming (UID 101980) |
|---|
| ارسال | 07/10/2026 02:16 PM (28 أيام منذ) |
|---|
| الاعتدال | 03/11/2026 01:19 PM (27 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 430256 [Netcore NBR100V2 1.3.240614.030928 /usr/bin/auto_ac msg_aes_dec تلف الذاكرة] |
|---|
| النقاط | 20 |
|---|