CVE-2026-94100: critical vulnerability in Netcore NBR200V2
Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan_config_set_vlan buffer overflow
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.4epss 0.8%
A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wan_config_set_vlan of the file /usr/bin/routerd of the component WAN VLAN Reconfiguration. Executing a manipulation of the argument vlan_wanX.ports can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Affected products
Netcore · NBR200V2public PoCs found — 1
cve_referenceapp.notion.com/p/Netcore-NBR200V2-Vul-8-39f797159f158003ad3eff2fd36342b6unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Netcore NBR200V2
In the same product, most dangerous first.
CVE-2026-94097CRITICALNetcore NBR200V2 CGI Diagnostic Endpoint network_tools command injectionEPSS 3.0%CVE-2026-101001CRITICALNetcore NBR200V2 Web Management network_tools eval os command injectionEPSS 2.6%CVE-2026-94098CRITICALNetcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injectionEPSS 2.4%CVE-2026-94095CRITICALNetcore NBR200V2 Traceroute Diagnostic Feature network_tools command injectionEPSS 2.4%CVE-2026-94096CRITICALNetcore NBR200V2 LAN IP Configuration network_tools command injectionEPSS 2.0%CVE-2026-94099CRITICALNetcore NBR200V2 Backup Restore restore.cgi command injectionEPSS 1.7%