{"id":"CVE-2026-121382","kind":"vulnerability","aliases":["CVE-2026-121382"],"related":[],"title":"Netcore NBR100V2 router: integer overflow in msg_aes_dec allows remote attack","description":"A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A flaw in the msg_aes_dec function of the /usr/bin/auto_ac component on Netcore NBR100V2 routers (firmware 1.3.240614.030928) causes an integer overflow. A remote attacker can trigger it over the network, and the exploit has been publicly disclosed.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NBR100V2","fixed":[],"affected":"1.3.240614.030928","ecosystem":"firmware"}],"ecosystems":[],"tags":["firmware","infrastructure","nbr100v2","netcore","router"],"not_affected_if":["other-firmware-versions"],"how_to_check":"- Log in to the router admin page and read the firmware version; 1.3.240614.030928 is the affected build.\n- With shell access, check that /usr/bin/auto_ac exists and whether it listens: run 'netstat -lnp' (or 'ss -lnp') and look for auto_ac. Whether it is reachable from WAN is not established by any source; test from outside your network or confirm the WAN firewall blocks it.\n- Also check other Netcore/Netis models that share firmware code (NBR200V2, NBR1005GPEV2), which are not confirmed affected.","fix":null,"status":"open","published_at":"2026-11-03T19:18:01+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","triaged_at":"2026-11-03T19:45:30+00:00","updated_at":"2026-11-03T19:46:36+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T19:45:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Netcore NBR100V2 router: integer overflow in msg_aes_dec allows remote attack","impact":"high","summary":"A flaw in the msg_aes_dec function of the /usr/bin/auto_ac component on Netcore NBR100V2 routers (firmware 1.3.240614.030928) causes an integer overflow. A remote attacker can trigger it over the network, and the exploit has been publicly disclosed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netcore","nbr100v2","router","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker may corrupt memory on the router","analyst_note":"Confirm whether the auto_ac service is reachable from WAN and whether a fix or workaround exists; the vendor did not respond to disclosure, check the NVD entry for updates.","how_to_check":"- Check the firmware version on the device against `1.3.240614.030928`\n- Look for the file `/usr/bin/auto_ac` on the router, if you have shell access\n- unknown for further checks, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["other-firmware-versions"],"who_is_affected":"Owners of Netcore NBR100V2 routers running firmware 1.3.240614.030928 are exposed, since the flawed code is in the router's own auto_ac binary. The sources do not say whether the flaw needs a particular configuration or service to be reachable. The vendor did not respond to early disclosure, so no patch is stated.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4154,"output_tokens":601,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether the auto_ac service is reachable from WAN and whether a fix or workaround exists; the vendor did not respond to disclosure, check the NVD entry for updates.","search":"'-121382':15A,18A '-2026':14A,17A '/usr/bin/auto_ac':35B,84C '1.3.240614.030928':42B,70C 'ae':8A,30B,79C 'affect':71C 'allow':10A 'attack':12A,49B,94C 'caus':43B,87C 'compon':36B 'contact':110C 'cve':13A,16A 'dec':9A,31B,80C 'determin':66C 'disclos':62B,102C 'disclosur':114C 'earli':111C 'exploit':58B,91C,98C 'file':83C 'firmwar':20B,41B 'flaw':26B 'function':32B,77C 'infrastructur':21B 'integ':4A,45B,88C 'issu':74C 'manipul':86C 'may':104C 'msg':7A,29B,78C 'nbr100v2':2A,19A,22B,39B,69C 'netcor':1A,23B,38B,68C 'network':55B 'overflow':5A,46B,89C 'possibl':96C 'public':61B,101C 'remot':11A,48B,90C 'respond':118C 'router':3A,24B,40B 'trigger':51B 'util':106C 'vendor':108C 'vulner':64C 'way':121C","nicknames":[],"mitigations":[],"who_affected":"Owners of Netcore NBR100V2 routers on firmware 1.3.240614.030928 are the only confirmed affected systems. The record (NVD/VulDB text) says the integer overflow in msg_aes_dec in /usr/bin/auto_ac can be triggered remotely and that an exploit is public, but no source I found says whether auto_ac listens on the WAN side or on the LAN only. The CVSS vector rates impact as availability only (a crash or denial of service), not code execution. Other Netcore models and firmware versions are not confirmed affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["nbr100v2"],"ptokens":["nbr100v2"],"labels":["firmware","high","infrastructure","nbr100v2","netcore","router"],"campaign_type":null,"first_public_at":"2026-11-03T19:18:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121382","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121382","severity":null,"published_at":"2026-11-03T19:18:01+00:00","modified_at":"2026-11-03T19:18:01+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","fetched_at":"2026-11-03T19:44:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121382:1525","url":null,"severity":null,"published_at":"2026-11-03T19:46:36+00:00","modified_at":"2026-11-03T19:46:36+00:00","first_seen_at":"2026-11-03T19:46:36+00:00","fetched_at":"2026-11-03T19:46:36+00:00","note":"No vendor advisory exists: Netcore did not respond to VulDB disclosure per NVD text. Only NVD record found; no fix, no PoC link, no WAN reachability evidence found. CVSS 4.0 vector is AV:N with availability-only impact. Sibling NBR100V2 CVEs (CVE-2026-101000 unauth ubus ACL) exist but are separate. Not marked verified."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}