CVE-2026-101000

Executive Summary

CVE-2026-101000 is a missing authorization vulnerability (CWE-862) affecting the Netcore NBR100V2 router running firmware version 1.3.240614.030928. The flaw resides in the ACL Handler component, where the uci.apply function fails to enforce authorization checks, allowing unauthenticated remote attackers to manipulate a configuration argument and invoke privileged UCI operations. With a CVSS v3.1 base score of 10.0 and a publicly disclosed exploit, this vulnerability represents a critical risk to any exposed Netcore NBR100V2 device, enabling full compromise of the router's configuration and dependent network segments.

Technical Analysis

The vulnerability is classified as CWE-862 (Missing Authorization). According to the NVD description, the issue affects the uci.apply function of the file /usr/share/rpcd/acl.d/unauthenticated.json, which is part of the ACL (Access Control List) Handler component. In OpenWrt-derived firmware such as Netcore's NBR100V2, rpcd (the RPC daemon) uses JSON ACL definition files stored under /usr/share/rpcd/acl.d/ to declare which RPC methods each permission group may invoke. The file named unauthenticated.json is intended to enumerate RPC methods accessible to unauthenticated users. When the ACL definition incorrectly or over-broadly grants access to the uci.apply method, any remote client that can reach the rpcd HTTP/JSON-RPC interface can invoke uci.apply without credentials.

The uci.apply method is a configuration commit primitive: it takes a configuration section argument and applies pending UCI (Unified Configuration Interface) changes, typically via uci commit semantics. Because the authorization control is missing (rather than the input validation), the attacker does not need to defeat authentication — they simply reach the endpoint that the ACL incorrectly exposes. Manipulation of the section argument lets the attacker target arbitrary UCI configuration sections (for example, network, wireless, DHCP, or firewall configuration), causing unauthorized configuration changes. The CVSS scope metric is S:C (Changed), reflecting that a compromise of the router component can impact resources beyond its own security scope — i.e., the downstream network. The attack vector is network (AV:N), complexity is low (AC:L), and no privileges or user interaction are required (PR:N, UI:N), consistent with a remotely reachable, unauthenticated RPC interface.

The NVD description does not disclose the exact HTTP transport (LuCI vs. direct rpcd/ubus JSON-RPC over HTTP), the exact JSON payload structure beyond the section argument name, or the port on which the rpcd HTTP interface is exposed. Those specifics are not available in the source data and should not be assumed.

Exploitation Scenarios

No public exploit code repository or Nuclei template was identified in the tracked sources, though the NVD description states the exploit has been publicly disclosed and "may be utilized." The attack chain below is inferred at the vulnerability-class level from the missing-authorization mechanism; it does not rely on any fabricated endpoints or parameter names beyond those given in the description (uci.apply, section, /usr/share/rpcd/acl.d/unauthenticated.json).

1. Reconnaissance / target identification. The attacker identifies internet- or LAN-exposed Netcore NBR100V2 devices running firmware 1.3.240614.030928, for example by using the Shodan dorks above or by scanning for the device's management/RPC interface. Because the vulnerability is network-reachable and requires no credentials, an exposed management interface is sufficient for targeting.

2. Triggering the flaw class. The attacker discovers that the ACL Handler's unauthenticated.json definition grants the uci.apply method to unauthenticated callers. Because authorization is missing (CWE-862), the attacker sends a request to the relevant RPC interface invoking uci.apply without authenticating.

3. Payload / execution method (class level). The attacker supplies a manipulated section argument in the uci.apply call. Because the function applies UCI configuration changes, the manipulated section directs the commit against attacker-chosen configuration state. No specific payload schema is described in the source data; the defining characteristic is that an unauthenticated caller controls the section argument and thereby causes configuration changes.

4. Post-exploitation impact. Successful invocation grants the attacker the ability to alter device configuration without authorization. Given the Changed-scope CVSS rating and High confidentiality, integrity, and availability impact, realistic consequences include redirecting DNS or traffic, modifying firewall/network settings, disrupting the device, or establishing persistence through configuration changes. Because the description does not state whether arbitrary command execution is achieved, command execution should not be asserted as a confirmed outcome; the confirmed outcome is unauthorized configuration manipulation via uci.apply.

Impact Assessment

The CVSS v3.1 base score is 10.0 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Each subscore maps to concrete risk:

• AV:N (Network) — exploitable remotely; exposure depends on whether the RPC/management interface is reachable.
• AC:L (Low) — no special conditions or race windows are required.
• PR:N (None) — no authentication is needed; this is the core of the missing-authorization flaw.
• UI:N (None) — no victim interaction required.
• S:C (Changed) — impact extends beyond the vulnerable router component to connected systems/network segments.
• C:H / I:H / A:H — the attacker can affect confidentiality, integrity, and availability of the affected environment through unauthorized configuration control.

Blast radius: any Netcore NBR100V2 device at firmware 1.3.240614.030928 whose RPC interface is reachable by an untrusted network. Routers typically sit at trust boundaries, so compromise can expose or redirect all downstream traffic. Because no patch exists and no EPS score has been published by FIRST.org, prioritization must rely on exposure: internet-facing or guest-accessible management interfaces are the highest priority.

Detection Guidance

Detection should focus on unauthenticated or anomalous uci.apply invocations against the rpcd interface, on configuration changes made outside authorized administrative sessions, and on the corresponding network requests. Because exact wire format is not disclosed, rules below use the confirmed function name (uci.apply), argument name (section), and path fragment (rpcd/uci) as anchors and should be tuned to observed traffic.

Sigma Rule

title: Unauthenticated uci.apply Invocation via rpcd ACL Handler (CVE-2026-101000)
id: 8f2c1d6a-3b7e-4a91-9c0e-7d5a1e2f4b33
status: experimental
description: Detects requests invoking the uci.apply RPC method, indicative of exploitation of the missing authorization flaw in the Netcore NBR100V2 ACL Handler.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101000
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_method:
    cs-uri-query|contains:
      - 'uci'
      - 'apply'
  selection_body:
    cs-body|contains:
      - 'uci.apply'
      - '"section"'
  condition: selection_method and selection_body
fields:
  - c-ip
  - cs-uri
  - cs-uri-query
  - cs-body
falsepositives:
  - Legitimate authenticated administrative use of UCI apply
level: high
tags:
  - attack.t1190
  - cve.2026.101000

YARA Rule

rule CVE_2026_101000_Netcore_NBR100V2_ACL
{
    meta:
        description = "Detects ACL Handler artifacts referencing unauthenticated uci.apply access for CVE-2026-101000"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101000"
        date = "2026-01-01"

    strings:
        $acl_file = "/usr/share/rpcd/acl.d/unauthenticated.json" ascii
        $m1 = "uci.apply" ascii
        $m2 = "uci" ascii
        $m3 = "apply" ascii
        $arg = "section" ascii

    condition:
        $acl_file or ($m1 and $arg) or ($m2 and $m3 and $arg)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101000 Netcore NBR100V2 Unauthenticated uci.apply Invocation"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"uci"; nocase; http.request_body; content:"uci.apply"; nocase; http.request_body; content:"section"; nocase; reference:cve,2026-101000; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101000; classtype:attempted-admin; sid:2026101000; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and http.method == "POST" and
     wildcard(url.path, "*uci*")]
  [network where network.protocol == "http" and
     wildcard(http.request.body, "*uci.apply*") and
     wildcard(http.request.body, "*section*")]

Splunk SPL Query

index=web OR index=proxy OR index=network
| eval body=coalesce(http_request_body, cs_body, request_body), uri=coalesce(uri_path, cs_uri, url)
| where match(lower(uri), "uci") OR match(lower(body), "uci\.apply")
| where match(lower(body), "uci\.apply") OR match(lower(body), "\"section\"")
| table _time, src_ip, dest_ip, uri, body
| sort - _time

Wazuh OSSEC Rule

<group name="netcore,cve-2026-101000,">
  <rule id="101000" level="12">
    <decoded_as>json</decoded_as>
    <field name="request_body">uci\.apply</field>
    <description>CVE-2026-101000: Possible unauthenticated uci.apply invocation against Netcore NBR100V2 ACL Handler</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="101001" level="10">
    <decoded_as>json</decoded_as>
    <field name="request_body">"section"</field>
    <description>CVE-2026-101000: uci.apply section argument manipulation - possible exploitation attempt</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. The vendor was contacted early about this disclosure but did not respond, and no patch source has been identified. No fixed version exists in the tracked data.

1. Immediate mitigations (until a patch exists).

   • Remove or restrict network exposure of the device management/RPC interface. Do not expose the Netcore NBR100V2 management interface to the internet or to untrusted network segments.
   • Place the device behind firewalls and restrict administrative access to a dedicated, trusted management VLAN.
   • If the ACL definition file /usr/share/rpcd/acl.d/unauthenticated.json is editable on the device, remove the over-broad uci.apply grant from the unauthenticated permission set so that the method requires authentication. Validate any such change against the device's expected operation before relying on it.
   • Monitor for and alert on unauthenticated uci.apply invocations (see Detection Guidance) as a compensating detective control.

2. Patch / upgrade steps.

   • No vendor patch is available. Monitor the Netcore vendor channel and NVD entry for CVE-2026-101000 for a fixed firmware release.
   • Given patch confidence 0/4 and the vendor's non-response, treat the affected firmware as permanently vulnerable until an official fix is published, and consider hardware replacement with a supported product whose firmware is actively maintained.

3. Long-term hardening.

   • Enforce authentication and least-privilege authorization on all RPC/ACL definitions (/usr/share/rpcd/acl.d/), and audit such files to ensure no privileged methods are exposed to the unauthenticated permission group.
   • Deploy network segmentation so that compromise of a single edge device does not yield Changed-scope impact across downstream segments.
   • Maintain firmware inventory and patch SLAs for edge devices; incorporate CVE monitoring for the router/CPE estate.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-101000
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS: Not yet scored for CVE-2026-101000 (no published value)
• CISA KEV: Not listed (as of report generation)

Exploit-in-the-wild evidence: The NVD description states the exploit has been publicly disclosed and "may be utilized." No specific public PoC repository, exploit code, Nuclei template, or attributed threat-actor campaign was identified in the tracked sources. The vendor was contacted about this disclosure but did not respond in any way.