CVE-2026-78795

Executive Summary

CVE-2026-78795 is a remote sensitive information disclosure vulnerability in the Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router (firmware v1.3.241114.024540 and earlier). A remote, unauthenticated attacker may be able to retrieve sensitive information from the device. Because no patch, CNA title, CWE assignment, or public proof-of-concept is available, exploitation specifics remain inferred from the vulnerability class. Netcore B11 devices are typically deployed as internet-facing edge routers in retail, branch, and SMB environments, where exposed management services represent the primary attack surface.

Technical Analysis

The vulnerability class is sensitive information disclosure (CWE-200): an attacker who can reach a vulnerable service on the device can obtain data that should not be exposed to unauthorized parties. The NVD description does not specify the retrieval vector, the exposed resource, the protocol, or the exact data type leaked. Consequently, this analysis deliberately avoids asserting specific endpoints, parameters, or functions, none of which are present in the source data.

What can be stated with confidence from the supplied data:

• Affected product: Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router.
• Affected firmware: v1.3.241114.024540 and all earlier releases (version string encodes a date-style build identifier: 2024-11-14).
• Access vector: Remote (network-reachable).
• Authentication requirement: None stated; the description says "a remote attacker," not "an authenticated attacker."
• Impact category: Sensitive information disclosure.

Likely exposure categories for this class of device. Information-disclosure issues on SMB/edge routers commonly fall into a small number of families:

1. Unauthenticated configuration or status endpoints that return device configuration, credential material, or session tokens without requiring authentication (e.g., missing access control on diagnostic/backup/session API routes).
2. Information leakage in responses — verbose error messages, stack traces, debug headers, or build/version metadata that aid further exploitation.
3. Predictable or exposed access controls on administrative interfaces, where static or guessable paths expose sensitive pages.

Because the CNA title is empty and no CWE was assigned by the source, the precise family cannot be determined from the available data. Analysts should treat this report as a class-level assessment and validate specifics against the device itself in an authorized lab.

Attack surface. The B11 is a multi-port gigabit wireless router intended for shop/branch deployments. Its attack surface includes the web-based management interface, any exposed remote-management service, and firmware update paths. If the leaked information includes administrative credentials, session tokens, or internal network configuration, this vulnerability becomes a precursor to full device compromise and lateral movement into the protected LAN.

Root cause. Undetermined. The description asserts the outcome (sensitive information obtainable remotely) without describing the mechanism. No code-level detail is provided, so no root-cause claim is made here.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code exists in the tracked data. The following chain is therefore an inference based on the vulnerability class (remote sensitive information disclosure) and the NVD description wording. No public PoC available; attack chain is inferred from vulnerability class. No specific endpoints, functions, or parameters are asserted because none are provided.

1) Reconnaissance / target identification. An attacker scans the public IPv4 space for internet-exposed Netcore B11 management interfaces. Identification is performed by banner grabbing, HTTP response fingerprinting, and inspection of page titles and HTML content for Netcore/B11 identifiers. Shodan and similar search engines can be used to locate candidate hosts via device-specific HTTP fingerprints (see SHODAN_DORKS). The attacker confirms the target runs firmware at or below v1.3.241114.024540 where a version banner is exposed.

2) Triggering the information-disclosure flaw. Because the vulnerability is a disclosure class issue, the trigger is a request to a resource that returns sensitive data without adequate access control. At the class level, this means the attacker issues a network request to the exposed management service and receives information that should have required authorization. The description does not specify whether this is a GET, POST, or other request, nor which service (HTTP/HTTPS, other) is involved. Analysts should not assume a particular URI or parameter.

3) Payload / execution method (class level). No code execution or payload delivery is described. The "payload" in a pure information-disclosure case is simply the crafted request; the vulnerability is exercised by the act of querying the unprotected resource. Where the disclosed content is cacheable or returned in error paths, repeated requests may yield additional data. Again, no specific request format is asserted here.

4) Post-exploitation impact. Depending on what is actually leaked — which the source data does not state — possible outcomes include: harvest of administrative credentials or session tokens enabling full device takeover; disclosure of network topology, WLAN credentials, or VPN configuration enabling lateral movement; and intelligence gathering that supports subsequent exploitation of other router flaws. If the leaked information is limited to non-credential metadata, impact is confined to reconnaissance.

Constraints and preconditions. The attacker requires network reachability to the vulnerable interface. If the management interface is restricted to the LAN or VPN, the exposure is limited to insiders or attackers who already have a network foothold; if it is internet-facing, the exposure is global and unauthenticated.

Impact Assessment

Confidentiality: High, at the class level — the flaw's defining outcome is unauthorized access to sensitive information. The NVD description uses the phrase "obtain sensitive information," which supports rating confidentiality impact as the dominant component.

Integrity: Not established by the source data. If disclosed data includes credentials, integrity impact materializes indirectly through follow-on authentication.

Availability: Not established by the source data.

Scope: Assumed unchanged (the vulnerable component and the impacted component are the same device). Note: the CVSS vector proposed in METADATA is an assessment derived from the vulnerability class and the description text; the CNA/NVD has not published an official score and this CVE currently carries N/A for CVSS. Treat the vector as an analytical placeholder, not an authoritative score.

Blast radius. Netcore B11 units are deployed as the network gateway in shops, branch offices, and small enterprises. Compromise or significant information leakage at this layer can expose every downstream host on that network. Where the device serves as a VPN endpoint or terminates remote-management tunnels, exposure extends to the broader enterprise network.

Exploitability context. EPSS has not yet scored this CVE; no EPSS value is available and none should be assumed. The CVE is not listed in CISA KEV, and no public exploit code, PoC, or Nuclei template is available in the tracked data. Absence of an observed exploit does not imply low risk: internet-facing edge routers are heavily targeted, and disclosure flaws frequently become precursors in multi-stage campaigns.

Business impact categories: privacy/regulatory exposure if customer or employee data traverses the device; operational disruption if credentials leak and device settings are later altered; and downstream network compromise given the gateway role of the device.

Detection Guidance

Detection strategy for this CVE is fundamentally hampered by the lack of a specified exploit vector. The rules below are therefore built around the observable class-level behaviors of an information-disclosure attack against a router management plane: anomalous unauthenticated access to management resources, high-rate enumeration, and post-disclosure credential-reuse artifacts. All rules are illustrative and should be tuned to the environment. Signature content keyed to a specific URI or parameter cannot be written accurately because the source data does not provide one; fabricating such identifiers would produce false confidence.

Sigma Rule

title: Potential Netcore B11 Router Information Disclosure Enumeration
id: 3f0f28c7-5a1c-4c0a-9c3b-8b5e2e9a7a41
status: experimental
description: Detects repeated unauthenticated requests to a gateway/router management interface consistent with information-disclosure enumeration (CVE-2026-78795 class, CWE-200).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78795
author: valtersit.com
date: 2026-01-01
logsource:
  category: web
  product: generic
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_router_fp:
    - cs-uri-query|contains: 'netcore'
    - cs-user-agent|contains: 'Netcore'
    - cs-referer|contains: 'netcore'
  filter_success_but_sensitive:
    sc-status:
      - 200
      - 301
      - 302
  timeframe: 5m
  condition: selection_method and selection_router_fp and filter_success_but_sensitive | count() by src_ip > 30
falsepositives:
  - Legitimate administrative polling from a management platform
  - Vulnerability scanners operated by the security team
level: medium
tags:
  - attack.t1190
  - cve.2026.78795

Note: cs-uri-query|contains: 'netcore' is a product-fingerprint heuristic, not a known endpoint. Sigma syntax above is structurally valid; adjust field mappings to your web log source (e.g., reverse-proxy, WAF, or Zeek HTTP).

YARA Rule

rule Netcore_B11_Info_Disclosure_CVE_2026_78795
{
    meta:
        description = "Detects Netcore B11 firmware/response artifacts associated with the affected version range for CVE-2026-78795"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78795"
        tlp = "WHITE"

    strings:
        $v1 = "Netcore" ascii nocase
        $v2 = "B11" ascii
        $v3 = "v1.3.241114.024540" ascii
        $v4 = "1.3.241114" ascii
        $v5 = "Netcore B11" ascii nocase
        $builddate = "241114" ascii

    condition:
        uint16be(0) != 0x4d5a and
        (
            ( $v1 and ($v2 or $v5) ) or
            ( $v3 ) or
            ( $v4 and $builddate )
        )
}

This is a firmware/artifact identification rule (string match on product name, model, and the known affected build string), not an exploit-signature rule — an accurate exploit signature cannot be written for an unspecified disclosure vector. Apply it to captured firmware images, config backups, and response-body captures, not to an arbitrary live byte stream with the uint16be gate removed.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Possible Netcore B11 Router Information Disclosure Probe (CVE-2026-78795)"; flow:established,to_server; http.method; content:"GET"; http.header; content:"Netcore"; nocase; http.header; content:"B11"; nocase; threshold:type both, track by_src, count 30, seconds 300; reference:cve,2026-78795; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-78795; classtype:attempted-recon; sid:9000787; rev:1;)

Keyed on client fingerprint headers (Netcore/B11) at a request rate threshold to separate automated scanning from casual browsing. A URI-path match is intentionally not included because no specific path is documented for this CVE.

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "GET" and
      (url.full : "*netcore*" or user_agent.original : "*Netcore*") ]
  [ network where http.response.status_code == 200 and
      url.full : "*netcore*" ]

EQL requires network events enriched with HTTP fields. Tune the url.full/user_agent.original wildcards to your observed fingerprint; the sequence models the "enumerate then receive 200" pattern characteristic of disclosure probing. Because the exact URI is unknown, the pattern targets product fingerprinting rather than a fixed path.

Splunk SPL Query

index=web OR index=proxy OR index=zeek
(sourcetype=access_combined OR sourcetype=stream:http OR sourcetype=suricata)
| eval fp=lower(coalesce(uri, cs_uri, url, http_uri, "")) . " " . lower(coalesce(useragent, http_user_agent, http_user_agent, ""))
| where match(fp, "netcore|b11|241114")
| stats count AS attempts dc(uri) AS distinct_uris values(status) AS statuses BY src_ip
| where attempts > 50 OR distinct_uris > 20
| sort - attempts
| table src_ip attempts distinct_uris statuses

Flags high-rate, high-cardinality enumeration from a single source against Netcore-fingerprinted traffic. Thresholds are operational defaults; adjust to baseline. This detects the reconnaissance/trigger activity described in the Exploitation Scenarios section (step 2) without hard-coding an undocumented endpoint.

Wazuh OSSEC Rule

<group name="web,netcore,cve-2026-78795,">
  <rule id="100787" level="0">
    <decoded_as>web-accesslog</decoded_as>
    <match>Netcore|B11|241114</match>
    <description>Netcore B11 device fingerprint observed in web logs (baseline).</description>
  </rule>

  <rule id="100788" level="10" frequency="30" timeframe="300">
    <if_matched_sid>100787</if_matched_sid>
    <same_source_ip />
    <description>Repeated requests to Netcore B11 gateway from same source - possible information disclosure enumeration (CVE-2026-78795).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_78795,recon,</group>
  </rule>
</group>

frequency/timeframe implement the rate-based threshold. Ensure your decoder parses the srcip field so same_source_ip functions. Rules 100787/100788 are local custom-rule IDs in the user range.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. No vendor advisory, fixed firmware version, or workaround has been identified. Operators must assume the latest known affected firmware (v1.3.241114.024540) remains vulnerable until Netcore publishes a fix. Verify the vendor's current firmware release directly before relying on any version claim.

1) Immediate mitigations

• Remove internet exposure. The single most effective control for a network-reachable edge-device flaw is to stop exposing the management plane to the public internet. Restrict management access to a dedicated management VLAN or reachable only via VPN.
• Network segmentation and ACLs. Place the B11 management interface on a management network and enforce ACLs that allow only trusted administrative hosts to reach it.
• Disable unused services. Turn off remote management, UPnP, WAN-side web administration, and any diagnostic services not required for operations. Reduce the exposed attack surface to the minimum.
• Monitor for anomalous access. Apply the detection rules in this report to flag enumeration of the management interface and any unexpected unauthenticated access patterns.
• Credential hygiene. Rotate default and any reused administrative credentials, and enforce strong, unique passwords. If the weakness is credential leakage, this limits follow-on damage.
• Compensating controls at the perimeter. Use a WAF/reverse proxy or firewall rules to restrict which clients may reach the device's administrative paths.

2) Patch / upgrade steps

• There is currently no patch to apply. Monitor the Netcore support site and firmware download channel for the B11 model for a release newer than v1.3.241114.024540.
• Register affected devices for vendor security notifications and re-check the NVD entry for updates to the reference list, CNA title, and CWE assignment.
• When a fixed firmware is released: back up configuration, apply the update from a trusted network, verify the new version string, and re-validate that the disclosure behavior no longer reproduces.

3) Long-term hardening

• Maintain an accurate inventory of all Netcore B11 (and comparable edge) devices and their firmware versions; treat edge routers as tier-0 assets.
• Adopt a policy of zero internet exposure of device management planes across the fleet.
• Establish routine firmware review cycles independent of CVE publication, since router CVEs frequently lack timely advisories.
• Monitor outbound connections for data exfiltration consistent with credential or configuration leakage.
• Log and centrally retain management-plane access logs for the device class so the detection rules above have a data source.

References

1. NVD — CVE-2026-78795: https://nvd.nist.gov/vuln/detail/CVE-2026-78795
2. Netcore (vendor) support/download portal — check for a B11 firmware release newer than v1.3.241114.024540 (no advisory was available at the time of writing; consult the vendor directly).
3. FIRST EPSS — no score yet published for this CVE: https://www.first.org/epss/
4. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-78795 is not listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / exploit-in-the-wild evidence: None. No public PoC, exploit code, Nuclei template, or observed campaign is associated with CVE-2026-78795 in the tracked data. The absence of evidence reflects the immature state of the record, not a judgment that the flaw is unexploitable. Reassess promptly if the CNA publishes a title or reference, if a CVSS/CWE is assigned, or if EPSS or KEV status changes.