CVE-2026-101000CWE-862CWE-863broken-access-control

CVE-2026-101000

Critical · published September 28, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
EPSS
0.00501 · 42.0th percentile
Weaknesses
CWE-862 · Missing Authorization; CWE-863 · Incorrect Authorization
Published
2026-09-28T09:16Z
References (5)
https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NBR100V2_V1.3.240614.030928%20Router/netcore_nbr100v2_uci_config_tamper.md · [email protected]https://vuldb.com/cve/CVE-2026-101000 · [email protected]https://vuldb.com/submit/919999 · [email protected]https://vuldb.com/vuln/410870 · [email protected]https://vuldb.com/vuln/410870/cti · [email protected]
EPSS history
Timeline
  • 29 SEP 03:24Z
    EPSS moved — → 1%
    epss
  • 28 SEP 04:45Z
    Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization
    cvelistv5