CVE-2026-94100 in NBR200V2
Summary
by MITRE • 09/21/2026
A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wan_config_set_vlan of the file /usr/bin/routerd of the component WAN VLAN Reconfiguration. Executing a manipulation of the argument vlan_wanX.ports can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The Netcore NBR200V2 router, specifically running firmware version 1.3.241127.071246, contains a critical security flaw within its WAN VLAN reconfiguration component. This vulnerability resides in the wan_config_set_vlan function located inside the /usr/bin/routerd binary process. The core technical issue is classified as CWE-120, Buffer Copy without Checking Size of Input, commonly known as a buffer overflow. Specifically, when an attacker manipulates the vlan_wanX.ports argument during configuration requests, the application fails to properly validate or bound-check the input data before copying it into a fixed-size memory buffer. This lack of rigorous boundary checking allows maliciously crafted packets exceeding the expected length to overwrite adjacent memory locations on the stack or heap.
The operational impact of this vulnerability is severe due to its remote exploitable nature and the privileged context in which the routerd process typically operates. Because the flaw exists within a network-facing service handling configuration changes, an attacker can trigger the overflow from a remote location without requiring prior authentication if the management interface is exposed or misconfigured. The successful exploitation of this buffer overflow likely leads to arbitrary code execution on the device. Given that routers often run with elevated system privileges, gaining control over routerd could allow an adversary to take full administrative control of the network infrastructure. This enables activities such as traffic interception, man-in-the-middle attacks, DNS spoofing, and using the compromised device as a pivot point for further lateral movement within the internal network.
The severity of this issue is compounded by the fact that public exploit code has been released, significantly lowering the barrier to entry for attackers who may lack advanced reverse engineering skills. This availability increases the likelihood of automated scanning and exploitation campaigns targeting devices running vulnerable firmware versions. Furthermore, the vendor's failure to respond to early disclosure attempts indicates a critical gap in their security update lifecycle. Without an official patch or mitigation strategy provided by Netcore, administrators are left with limited options for remediation beyond immediate isolation or manual configuration hardening where possible.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK techniques related to Initial Access and Execution via network services. The exploitation vector suggests potential use in supply chain attacks or targeted intrusions against organizations relying on Netcore hardware for edge connectivity. To mitigate the risk while awaiting vendor intervention, administrators should restrict access to the router's management interface using strict firewall rules, limiting exposure only to trusted IP addresses. Disabling unnecessary WAN VLAN configuration features if not required can also reduce the attack surface. Additionally, implementing network segmentation ensures that even if a device is compromised, the blast radius remains contained within a specific subnet rather than affecting the entire corporate or home network infrastructure.