---
id: "CVE-2026-121382"
kind: "vulnerability"
aliases: ["CVE-2026-121382"]
title: "Netcore NBR100V2 router: integer overflow in msg_aes_dec allows remote attack"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NBR100V2", "fixed": [], "affected": "1.3.240614.030928", "ecosystem": "firmware"}]
ecosystems: []
tags: ["firmware", "infrastructure", "nbr100v2", "netcore", "router"]
not_affected_if: ["other-firmware-versions"]
published_at: "2026-11-03T19:18:01+00:00"
first_seen_at: "2026-11-03T19:44:52+00:00"
updated_at: "2026-11-03T19:46:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121382", "first_seen_at": "2026-11-03T19:44:52+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T19:46:36+00:00"}]
---

# Netcore NBR100V2 router: integer overflow in msg_aes_dec allows remote attack

A flaw in the msg_aes_dec function of the /usr/bin/auto_ac component on Netcore NBR100V2 routers (firmware 1.3.240614.030928) causes an integer overflow. A remote attacker can trigger it over the network, and the exploit has been publicly disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- firmware:NBR100V2 affected 1.3.240614.030928 fixed ?

## How to check

- Log in to the router admin page and read the firmware version; 1.3.240614.030928 is the affected build.
- With shell access, check that /usr/bin/auto_ac exists and whether it listens: run 'netstat -lnp' (or 'ss -lnp') and look for auto_ac. Whether it is reachable from WAN is not established by any source; test from outside your network or confirm the WAN firewall blocks it.
- Also check other Netcore/Netis models that share firmware code (NBR200V2, NBR1005GPEV2), which are not confirmed affected.

## Timeline

- 2026-11-03T19:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121382
- 2026-11-03T19:46:36+00:00 analyst — No vendor advisory exists: Netcore did not respond to VulDB disclosure per NVD text. Only NVD record found; no fix, no PoC link, no WAN reachability evidence found. CVSS 4.0 vector is AV:N with availability-only impact. Sibling NBR100V2 CVEs (CVE-2026-101000 unauth ubus ACL) exist but are separate. Not marked verified.

## From the sources

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_