CVE-2026-121382 in NBR100V2
Summary
by MITRE • 11/03/2026
A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified within Netcore NBR100V2 version 1.3.240614.030928 represents a critical security flaw located specifically within the msg_aes_dec function of the auto_ac binary file situated at /usr/bin/auto_ac. This component is integral to the device's network processing capabilities, likely handling encrypted communication payloads or configuration data transmission between the router and connected clients or upstream servers. The core technical defect is an integer overflow condition that arises during the manipulation of input data processed by this decryption routine. Integer overflows occur when a mathematical operation produces a numeric value that exceeds the maximum capacity for a specific data type, causing it to wrap around to a negative number or a very small positive number depending on whether signed or unsigned integers are used. In the context of memory management and buffer operations within embedded systems like network routers, such miscalculations frequently lead to incorrect allocation sizes or boundary checks, setting the stage for more severe exploitation vectors such as heap corruption or stack-based buffer overflows.
The operational impact of this vulnerability is significant due to its remote exploitable nature. Because the flaw resides in a function that processes incoming data packets, an attacker positioned on the network can craft maliciously formatted inputs designed to trigger the integer overflow condition without requiring prior authentication or physical access to the device. The fact that public exploits have been disclosed and are available for use dramatically lowers the barrier to entry for threat actors, enabling automated attacks against unpatched devices across the internet. This accessibility transforms a theoretical code defect into an immediate operational risk where attackers can potentially achieve arbitrary code execution, gain control over the router's operating system, or pivot through the network to compromise other internal assets. The lack of vendor response further exacerbates this risk by leaving administrators with no official patch timeline or guidance on temporary mitigations, forcing reliance on community-developed workarounds or immediate isolation strategies.
From a classification perspective, this vulnerability aligns closely with CWE-190, which defines integer overflow or wraparound errors, and often serves as the precursor to CWE-787, out-of-bounds write access if the overflow leads to writing data beyond allocated memory boundaries. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates techniques associated with Initial Access via Exploit Public-Facing Application (T1190) and potentially Privilege Escalation or Defense Evasion depending on how the resulting code execution is leveraged by an attacker to maintain persistence within the network infrastructure. The presence of a publicly available exploit places this vulnerability in a high-severity category requiring immediate attention, as it allows for widespread automated exploitation campaigns targeting unpatched Netcore devices globally.
Mitigation strategies must focus on both technical controls and administrative policies given the absence of vendor patches. Network segmentation is critical to limit exposure; administrators should ensure that management interfaces are not exposed directly to the internet or untrusted networks. If possible, implementing strict firewall rules to restrict access to the affected services from only trusted IP addresses can reduce the attack surface significantly. Additionally, enabling intrusion detection and prevention systems with signatures tailored to detect exploitation attempts of integer overflow vulnerabilities in embedded devices may provide a layer of defense against active attacks while waiting for vendor intervention or community-developed fixes. Organizations should also conduct an inventory audit to identify all instances of this specific firmware version and prioritize their replacement or upgrade as soon as the vendor issues a security update, ensuring that long-term remediation addresses the root cause rather than relying solely on perimeter defenses.