---
id: CVE-2026-94101
title: >-
  A security vulnerability has been detected in Netcore NBR200V2
  1.3.241127.071246
summary: >-
  A security vulnerability has been detected in Netcore NBR200V2
  1.3.241127.071246. The affected element is the function vlan_load_form_uci of
  the file /usr/bin/routerd. The manipulation of the argument wan_num leads to
  buffer overflow. It…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-119
  - CWE-120
vendor: Netcore
product: NBR200V2
affected:
  - NBR200V2 1.3.241127.071246
published: '2026-09-21'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T13:33:33.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94101'
references:
  - url: >-
      https://app.notion.com/p/Netcore-NBR200V2-Vul-9-39f797159f1580668db9e8df031dbdd5
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-94101'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/892995'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/408030'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/408030/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00445
epssPercentile: 0.37997
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-21T10:37:02.087741Z'
ingestedAt: '2026-09-21T01:29:29.703Z'
---

## Overview

A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/routerd. The manipulation of the argument wan_num leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.