CVE-2026-101188 Details
Description
A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability in Netcore POWER13 firmware version 2.0.240730.162638 allows for unauthenticated password resets through the ubus method 'routerd.passwd_set'. This issue arises from a lack of proper authentication and authorization, enabling remote attackers on the management network to reset the administrator password and gain privileged access to the device. The vulnerability has been publicly disclosed and exploited.
Netcore should remove 'routerd.passwd_set' from the unauthenticated ACL, eliminate unnecessary unauthenticated write permissions from 'rpcd', and ensure password-reset functions require a valid authenticated session. Operators should restrict access to the management interface, disable remote management when possible, rotate administrator credentials after applying patches, and monitor for unauthorized configuration changes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/l22Heart/cve_report/blob/main/Netcore_POWER13_Unauthenticated_routerd_passwd_set_Password_Reset_Vulnerability.md | [email protected] | ExploitRemedyTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-101188 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/906532 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/411009 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/411009/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Netcore POWER13 | V2.0.240730.162638 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 28, 2026 | New CVE Received | [email protected] |