Netcore NBR100V2 CVE-2026-121382

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special privileges are required, and the attack is reachable over the network against the affected NBR100V2 firmware. The concrete prerequisite is that the auto_ac binary exposing msg_aes_dec must be running and network-reachable on the device; the exact input or protocol that triggers the integer overflow is not described in the available sources. The key LIMITING factor is impact scope: the vector reports availability-only impact (VA:H, VC:N, VI:N), so successful exploitation yields denial of service rather than code execution or data disclosure. No fixed version or mitigation is listed, and the vendor did not respond to the disclosure.

The input CVSS 4.0 vector scores this 7.7 (HIGH), driven entirely by AV:N/AC:L/AT:N/PR:N/UI:N with availability-only impact (VA:H; VC:N, VI:N). In plain terms, the signals describe a remotely reachable, unauthenticated, low-complexity denial-of-service - not remote code execution - despite the CWE-190 integer overflow classification. The vuln.today decision label is 'this_week' and the vector's E:P indicates proof-of-concept exploit maturity, but there is NO CISA KEV listing and NO EPSS score in the provided data, so real-world exploitation probability cannot be quantified from these inputs. The only reporting source is VulDB (a single source); no independent vendor advisory exists because the vendor was contacted and did not respond. Net assessment: this is a plausibly-real but availability-limited issue in a niche router, not a confidentiality/integrity breach - the HIGH score reflects easy remote reachability, not severe impact. Treat it as a this_week DoS triage item rather than an emergency, while noting the conflict between the 'Information Disclosure' tag and the CVSS vector's VC:N (no confidentiality impact).

A remote, unauthenticated attacker sends crafted input to the network-facing auto_ac service on a Netcore NBR100V2 router, triggering an integer overflow in the msg_aes_dec function. Per the CVSS vector the resulting impact is loss of availability (the service/device crashing or becoming unresponsive), not data theft or code execution. A public exploit disclosure is referenced via VulDB, though the exact trigger is not described in the available sources.