CVE-2026-121382
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
In Netcore NBR100V2 1.3.240614.030928, the msg_aes_dec function in /usr/bin/auto_ac is affected by an integer overflow. Remote exploitation is possible, and the exploit has been publicly disclosed and may be utilized. The vendor was contacted early but did not respond.
Risk Assessment
A remote attacker may exploit the integer overflow, potentially leading to a crash or further compromise of the device. Public exploit disclosure increases the risk.
Recommendation
Restrict network access to the device and its management interfaces; contact the vendor for a fix and consider compensating controls until an update is available.
Other vulnerabilities in Netcore NBR100V2
Original NVD description (English source)
A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS