SECURITYCRITICALCVE-2026-94100

CVE-2026-94100: Buffer Overflow in Netcore NBR200V2 WAN VLAN Reconfiguration

A buffer overflow in Netcore NBR200V2's routerd WAN VLAN handler can be triggered remotely via the vlan_wanX.ports argument.

Dylan H.

Security Team

September 21, 2026
3 min read
CVE-2026-94100: Buffer Overflow in Netcore NBR200V2 WAN VLAN Reconfiguration

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Netcore NBR200V2 1.3.241127.071246

Overview

The sixth and final vulnerability in this disclosure batch for the Netcore NBR200V2 router, firmware version 1.3.241127.071246, is a buffer overflow — a departure from the command injection pattern in the other five flaws. Tracked as CVE-2026-94100, the bug affects wan_config_set_vlan() in /usr/bin/routerd, the WAN VLAN Reconfiguration component, and is triggered by manipulating the vlan_wanX.ports argument.

See Related Reading for the five command injection CVEs (94095–94099) disclosed alongside this one in the same firmware build.

Technical Details

FieldValue
CVE IDCVE-2026-94100
SeverityCritical (CVSS 3.1: 9.9)
WeaknessCWE-121 (Stack-based Buffer Overflow)
Vulnerable File/usr/bin/routerd
Functionwan_config_set_vlan
ComponentWAN VLAN Reconfiguration
Parametervlan_wanX.ports
AuthenticationNone required
Exploit MaturityPublic PoC available
Vendor ResponseContacted early, did not respond

How It Works

wan_config_set_vlan() copies the value of vlan_wanX.ports into a fixed-size buffer while applying a WAN-side VLAN port configuration, without validating the supplied value's length. An attacker who submits an oversized vlan_wanX.ports value overflows that buffer, corrupting adjacent stack memory in routerd — the core router daemon — and potentially hijacking control flow to execute attacker-supplied code, all without authentication.

Impact Assessment

Who Is At Risk

  • Any NBR200V2 unit on firmware 1.3.241127.071246 with the WAN configuration interface reachable — routerd is a core system process, so exploitation here is not limited to a peripheral diagnostic tool
  • No vendor patch exists

Potential Impact

  • Code execution within the core router daemon, which manages routing, WAN connectivity, and (per this same bug class) VLAN configuration — a more central process than the CGI/diagnostic tooling affected by the other five CVEs in this cluster
  • Denial of service at minimum (crashing routerd disrupts WAN connectivity for the entire device) up to full remote code execution if the overflow is reliably weaponized
  • Full device and downstream network compromise

Mitigation

  • Restrict access to the WAN configuration interface to trusted management hosts only; disable remote/WAN-side administration
  • Deploy network-layer monitoring for routerd crashes or restarts, which can indicate exploitation attempts
  • Apply length/bounds validation upstream via any available config-management proxy if direct firmware patching isn't possible — though this is a compensating control at best
  • No vendor patch exists; combined with the other five CVEs in this firmware, organizations should treat NBR200V2 hardware on this firmware version as unsuitable for continued production use

References

Related Reading