CVE-2026-101188 in POWER13
Summary
by MITRE • 09/29/2026
A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified within Netcore POWER13 firmware version 2.0.240730.162638 represents a critical authentication bypass mechanism located specifically within the routerd.passwd_set function of the ubus interface. This component is responsible for handling password modification requests, which are typically privileged operations requiring strict validation and secure storage practices. The core technical flaw lies in how this specific function processes input data during password reset or change scenarios. Instead of enforcing robust cryptographic standards or verifying current credentials before allowing a new password to be set, the implementation allows an attacker to manipulate the request parameters directly through the ubus API. This lack of proper validation enables an adversary to bypass standard authentication checks and establish administrative access with weak or predetermined passwords that may have been previously disclosed in exploit code available on public repositories.
From an operational perspective, this vulnerability poses a severe risk to network integrity because it can be exploited remotely without requiring prior local access. An attacker located anywhere on the internet who has identified a device running the affected firmware version can send crafted requests to the ubus interface to reset administrative credentials. Once successful, the attacker gains full control over the router, which serves as the primary gateway for all connected devices and network traffic. This level of compromise allows for extensive malicious activities including DNS hijacking, man-in-the-middle attacks on internal communications, interception of sensitive data such as login credentials or financial information, and the use of the compromised device as a node in botnets like Mirai. The fact that public exploit code exists significantly lowers the barrier to entry for attackers, increasing the likelihood of automated scanning and exploitation campaigns targeting vulnerable devices globally.
The vendor's lack of response to early disclosure attempts exacerbates the severity of this issue by leaving users without official patches or configuration guidance. In such scenarios, mitigation strategies must be implemented at the network perimeter level rather than relying on firmware updates. Administrators should immediately restrict access to the router’s management interface and ubus endpoints from untrusted networks using firewall rules that limit connectivity to trusted IP addresses only. Additionally, disabling remote administration features if they are not strictly necessary is a crucial step in reducing the attack surface. For devices already compromised or where patching is impossible due to vendor silence, changing default credentials to strong, unique passwords and ensuring that no weak password recovery mechanisms remain active can help mitigate immediate risks while monitoring network traffic for signs of exploitation such as unusual outbound connections or DNS anomalies indicative of botnet activity.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories related to authentication bypasses and improper input validation, specifically reflecting weaknesses in how privileged functions handle state changes without adequate verification. In the context of the MITRE ATT&CK framework, this flaw facilitates initial access techniques where adversaries leverage publicly available exploits against known vulnerabilities to gain footholds within networks. The remote nature of the exploit combined with the ability to reset administrative passwords places it firmly within high-severity threat vectors that require immediate attention from security operations centers and network administrators responsible for maintaining IoT device hygiene.