Is CVE-2026-101000 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101000 being exploited in the wild.

How severe is CVE-2026-101000?

Critical severity, with a CVSS score of 10, published 28 September 2026.

Which products and versions are affected?

Netcore NBR100V2 1.3.240614.030928.

Is there a fix for CVE-2026-101000?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-101000 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-101000?

Check whether you run Netcore NBR100V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101000: Netcore NBR100V2 missing authorization in ACL handler

CVE-2026-101000 · Severity: critical · CVSS 10 · Published 2026-09-28

The Netcore NBR100V2 router contains a critical authorization bypass in its configuration management system. When a router is unconfigured (factory default or after factory reset), an attacker on the local network can remotely modify WiFi settings, update sources, and other configurations without authentication. This allows attackers to steal WiFi credentials, perform man-in-the-middle attacks, or redirect firmware updates to malicious sources.

Vendors: Netcore.

Quick answers

Is CVE-2026-101000 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101000 being exploited in the wild.
How severe is CVE-2026-101000?: Critical severity, with a CVSS score of 10, published 28 September 2026.
Which products and versions are affected?: Netcore NBR100V2 1.3.240614.030928.
Is there a fix for CVE-2026-101000?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-101000 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-101000?: Check whether you run Netcore NBR100V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the uci.apply function of the ACL handler (/usr/share/rpcd/acl.d/unauthenticated.json) which fails to properly enforce authorization checks. When the device is unconfigured (initialized=0), the rpcd daemon permits unauthenticated remote callers to invoke uci.set and uci.apply methods via the /ubus JSON-RPC endpoint to modify wificfg, system, and auto_update configuration files. The uci.apply call directly commits changes to persistent storage with a service reload, making modifications survive reboot until factory reset.

Affected products

Netcore NBR100V2 1.3.240614.030928

Timeline

2026-09-28: disclosed: Publicly disclosed on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.