Vulnerability · Published Nov 3, 2026 · Assigned by VulDB

CVE-2026-121382Netcore NBR100V2 auto_ac msg_aes_dec integer overflow

High 7.5

In plain English

A high-severity integer overflow in NBR100V2 from Netcore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 52.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Netcore	NBR100V2	1.3.240614.030928

Weakness: CWE-190, CWE-189 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:C

References

VDB-430256 | Netcore NBR100V2 auto_ac msg_aes_dec integer overflow vdb-entry, technical-description
VDB-430256 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-121382 | CVE Analysis and Report third-party-advisory
Submit #1018496 | Netcore NBR100V2 1.3.240614.030928 denial of service third-party-advisory