Live › vulnerability › CVE-2026-121382
A flaw in the msg_aes_dec function of the /usr/bin/auto_ac component on Netcore NBR100V2 routers (firmware 1.3.240614.030928) causes an integer overflow. A remote attacker can trigger it over the network, and the exploit has been publicly disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 19:44 UTC. All times on this page are UTC.
Owners of Netcore NBR100V2 routers on firmware 1.3.240614.030928 are the only confirmed affected systems. The record (NVD/VulDB text) says the integer overflow in msg_aes_dec in /usr/bin/auto_ac can be triggered remotely and that an exploit is public, but no source I found says whether auto_ac listens on the WAN side or on the LAN only. The CVSS vector rates impact as availability only (a crash or denial of service), not code execution. Other Netcore models and firmware versions are not confirmed affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| NBR100V2 | firmware | 1.3.240614.030928 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121382")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.