| Title | Netcore磊科 Router Firmware NBR100V2_V1.3.240614.030928 missing-authorization vulnerability |
|---|
| Description | A missing-authorization vulnerability (CWE-862), combined with missing authentication for a critical function (CWE-306), was identified in the Netcore NBR100V2 router, firmware version V1.3.240614.030928 (LEDE 17.01-SNAPSHOT, mipsel / MT7621).
The web management interface (uhttpd, ports 80/443/23355) exposes the ubus JSON-RPC endpoint /ubus, backed by /sbin/rpcd. Authorization of ubus calls is enforced by rpcd against per-role ACL files via two independent layers: the ubus-method layer (write.ubus.uci) and the configuration-file layer (write.uci). The ACL file /usr/share/rpcd/acl.d/unauthenticated.json, loaded while the device is in its factory-default / unconfigured state (system.@system[0].initialized=0), grants an anonymous ubus session ("00000000000000000000000000000000") the right to invoke the uci methods "set" and "apply" (write.ubus.uci = get/set/apply) AND to modify the "wificfg", "system" and "auto_update" configuration files (write.uci).
In this firmware's rpcd, uci.apply performs the commit step internally (staging -> /etc/config on the persistent jffs2 overlay) followed by a service reload, so a single uci.set + uci.apply sequence persistently changes the configuration (survives reboot; cleared only by factory reset).
As a result, an unauthenticated remote attacker on the LAN can persistently modify the WiFi configuration (wificfg: SSID/key/encryption, enabling WiFi credential theft, rogue-AP / MitM) and the OTA/auto-update configuration (auto_update: update server / enable flags, enabling tampering with the firmware update source), as well as the system configuration (hostname/timezone). Configurations such as firewall, dropbear and network are NOT in the write.uci list and cannot be modified through this issue.
Exploitation requires NO credentials and is confined to the factory-default / unconfigured window; after the first user configuration, routerd.param_status_set atomically replaces the ACL with the restricted unauthenticated.json.initialized, which drops anonymous uci write access.
Proof of concept (no credentials, persistently modify auto_update):
POST /ubus HTTP/1.1
Content-Type: application/json
{"jsonrpc":"2.0","id":1,"method":"call","params":["00000000000000000000000000000000","uci","set",{"config":"auto_update","section":"control","values":{"agent_enable":"9"}}]}
-> {"jsonrpc":"2.0","id":1,"result":[0]}
{"jsonrpc":"2.0","id":1,"method":"call","params":["00000000000000000000000000000000","uci","apply",{}]}
-> {"jsonrpc":"2.0","id":1,"result":[0]}
After apply, /etc/config/auto_update on the device is persistently modified (option agent_enable '9'). The same sequence on config "wificfg" alters the WiFi SSID/key. The section argument accepts either a concrete section name or the indexed form @<type>[<index>].
The vulnerability was dynamically verified against the firmware emulated with qemu-mipsel; the anonymous session was accepted by rpcd and the configuration was persistently modified via /ubus (confirmed on disk after apply). Full details at <GITHUB_ADVISORY_URL>.
|
|---|
| Source | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NBR100V2_V1.3.240614.030928%20Router/netcore_nbr100v2_uci_config_tamper.md |
|---|
| User | llsss (UID 96233) |
|---|
| Submission | 08/10/2026 08:26 (2 months ago) |
|---|
| Moderation | 09/27/2026 12:25 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 410870 [Netcore NBR100V2 1.3.240614.030928 ACL unauthenticated.json uci.apply section authorization] |
|---|
| Points | 20 |
|---|