CVE-2026-101188 describes a security vulnerability in Netcore POWER13 2.0.240730.162638 involving the routerd.passwd_set function within the /ubus file. The flaw allows remote attackers to manipulate password recovery processes, resulting in weak password recovery protections. The vulnerability is remotely exploitable without privileges or user interaction and impacts confidentiality, integrity, and availability. The vendor was notified but did not respond, and no patch or remediation is currently documented.

Successful exploitation can lead to unauthorized password recovery, potentially allowing attackers to gain access to sensitive systems or data. The vulnerability impacts confidentiality, integrity, and availability of the affected system. The public disclosure of exploit details increases the risk of exploitation, although no known active exploitation in the wild has been reported.

No official patch or remediation is currently available, and the vendor has not responded to disclosure. Organizations should monitor vendor communications for updates. Until a fix is provided, consider restricting remote access to the affected service and implementing compensating controls to limit exposure of the password recovery functionality.