CVE-2026-94101Disclosure

LOWCVSS 8.6 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/routerd. The manipulation of the argument wan_num leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

1.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-119CWE-120

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-09-21); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-09-21: 2Mentions · 2026-10-20: 1PoC Mentioned / Linked · 2026-10-20: 1Technical Details · 2026-09-21: 1Technical Details · 2026-10-20: 109-2110-20
Signal classification2 categories
Disclosure
266.7%
PoC
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-212
Disclosure2
2026-10-201
PoC1
Full discourse3 posts
  • VulDB 🛡@vuldb
    Disclosure

    We have just added an important vulnerability affecting Netcore NBR200V2 (CVE-2026-94101) https://vuldb.com/vuln/408030

    Post summary

    The text announces CVE-2026-94101 affecting Netcore NBR200V2 with a link to a vulnerability database, but provides no technical details, PoC, exploit code, patch, or exploitation status.

    00020154
    2.3K followersView on X
  • Hugo | DevOps | Cybersecurity@HugoValters
    PoC

    CVE-2026-94101: buffer overflow in Netcore NBR200V2 routerd (wan_num arg), remotely exploitable, public exploit out, vendor unresponsive. CVSS 9.9. Unpatched, no fix. Restrict exposure and monitor. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94101/ #Netcore #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text discloses CVE-2026-94101, a remotely exploitable buffer overflow (CVSS 9.9) in Netcore NBR200V2, confirms a public exploit is available, and notes no vendor patch exists, advising exposure restriction and monitoring.

    0000045
    1.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-94101 A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/routerd… https://www.cve.org/CVERecord?id=CVE-2026-94101

    Post summary

    The text discloses a newly discovered vulnerability (CVE-2026-94101) in Netcore NBR200V2 1.3.241127.071246 affecting the vlan_load_form_uci function in /usr/bin/routerd.

    00000903
    58.1K followersView on X

Explore more