CVE-2026-94100: Buffer Overflow in Netcore NBR200V2 WAN VLAN Reconfiguration

Overview

The sixth and final vulnerability in this disclosure batch for the Netcore NBR200V2 router, firmware version 1.3.241127.071246, is a buffer overflow — a departure from the command injection pattern in the other five flaws. Tracked as CVE-2026-94100, the bug affects wan_config_set_vlan() in /usr/bin/routerd, the WAN VLAN Reconfiguration component, and is triggered by manipulating the vlan_wanX.ports argument.

See Related Reading for the five command injection CVEs (94095–94099) disclosed alongside this one in the same firmware build.

Technical Details

How It Works

wan_config_set_vlan() copies the value of vlan_wanX.ports into a fixed-size buffer while applying a WAN-side VLAN port configuration, without validating the supplied value's length. An attacker who submits an oversized vlan_wanX.ports value overflows that buffer, corrupting adjacent stack memory in routerd — the core router daemon — and potentially hijacking control flow to execute attacker-supplied code, all without authentication.

Impact Assessment

Who Is At Risk

• Any NBR200V2 unit on firmware 1.3.241127.071246 with the WAN configuration interface reachable — routerd is a core system process, so exploitation here is not limited to a peripheral diagnostic tool
• No vendor patch exists

Potential Impact

• Code execution within the core router daemon, which manages routing, WAN connectivity, and (per this same bug class) VLAN configuration — a more central process than the CGI/diagnostic tooling affected by the other five CVEs in this cluster
• Denial of service at minimum (crashing routerd disrupts WAN connectivity for the entire device) up to full remote code execution if the overflow is reliably weaponized
• Full device and downstream network compromise

Mitigation

• Restrict access to the WAN configuration interface to trusted management hosts only; disable remote/WAN-side administration
• Deploy network-layer monitoring for routerd crashes or restarts, which can indicate exploitation attempts
• Apply length/bounds validation upstream via any available config-management proxy if direct firmware patching isn't possible — though this is a compensating control at best
• No vendor patch exists; combined with the other five CVEs in this firmware, organizations should treat NBR200V2 hardware on this firmware version as unsuitable for continued production use

References

• VulDB — CVE-2026-94100

Related Reading

• CVE-2026-94095: Netcore NBR200V2 Traceroute Command Injection Enables Root RCE
• CVE-2026-94096: Command Injection in Netcore NBR200V2 LAN IP Configuration Handler
• CVE-2026-94097: Netcore NBR200V2 CGI Diagnostic Endpoint Command Injection
• CVE-2026-94098: Command Injection in Netcore NBR200V2 Firmware Upgrade Endpoint
• CVE-2026-94099: Command Injection in Netcore NBR200V2 Backup Restore Endpoint