Netcore POWER13 CVE-2026-101188

Exploitation requires network access to the device's /ubus management interface and the ability to invoke the routerd.passwd_set function; per PR:N/UI:N no authentication or user interaction is needed, so it works against default configurations reachable on the network. The primary practical limit is exposure: if /ubus is only reachable from the LAN (typical for consumer routers), the attacker must be on the local network or the management interface must be exposed to the WAN. Affected build is Netcore POWER13 2.0.240730.162638; no patch is available because the vendor did not respond to the disclosure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack with no user interaction - a broadly reachable flaw where the /ubus routerd.passwd_set endpoint can be invoked without credentials. The SSVC/temporal signal E:P (Proof-of-Concept) is corroborated by a public GitHub exploit write-up, so 'publicly available exploit code exists' - but this is NOT active exploitation: there is no CISA KEV listing and no EPSS score in the input, so real-world exploitation volume is unquantified. The vendor's 6.9 (Medium) score rests on uniformly LOW impacts (VC:L/VI:L/VA:L), which likely understates the outcome: CWE-640 (weak password recovery) via an unauthenticated password-reset on a router's admin plane typically yields full device takeover, which would justify HIGH impacts. This is a genuine priority for anyone running the affected device because the access barrier is essentially zero and working exploit code is published, even though the numeric CVSS sits in the Medium band. Note also the input tag 'Information Disclosure' conflicts with the CWE-640 password-reset nature (an integrity/authentication issue, not primarily disclosure) - the classification should be verified.

An attacker on the network reaches the device's /ubus interface and issues a routerd.passwd_set call without authenticating, resetting or setting the router administrator password to a value they control. A public proof-of-concept write-up on GitHub documents the unauthenticated request, lowering the skill needed to reproduce it. Having captured the credential, the attacker logs into the admin panel and controls DNS, routing, and traffic for every device behind the router.