EUVD-2026-88082
GHSA-cxfg-m6vc-37mp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated ACL grants full config tampering (PR:N/AC:L), C/I/A:H; S:C because a compromised router impacts connected client systems; AV:N per vector though reach is often LAN-bound in practice.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify device configuration via the uci.apply function, as the /usr/share/rpcd/acl.d/unauthenticated.json ACL incorrectly grants this function to unauthenticated callers. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, so no vendor-released patch is identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the router's rpcd/ubus management interface (the OpenWrt-style RPC daemon); no credentials or user interaction are needed because the /usr/share/rpcd/acl.d/unauthenticated.json ACL grants the uci.apply function to unauthenticated callers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a maximum-severity signal set on paper: the input CVSS 4.0 vector is 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with full VC/VI/VA:H and subsequent-system SC/SI/SA:H) and public exploit code exists (SSVC exploitation status Proof-of-Concept, E:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis; the vendor did not respond to disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Netcore NBR100V2 in the estate and confirm which units are running firmware 1.3.240614.030928; immediately eliminate WAN exposure of the rpcd/ubus management interface by removing any port-forwarding, DMZ, UPnP, or cloud/remote-management rules that publish it to the internet, and confirm management access is limited to trusted administrative hosts or a dedicated management VLAN. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote attackers can enable Telnet on TOTOLINK X5000R AX1800 routers running firmware V9.1.0u.6369_B2023
Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated
OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arb
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e
Authenticated administrators of ASUS routers can execute arbitrary commands on the device by uploading a crafted file th
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.0712
Authenticated administrators of certain ASUS router models can abuse leftover debug code in the device's web management
Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker c
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today