This vulnerability affects the Netcore POWER13 product, specifically version 2.0.240730.162638. The issue lies in the routerd.passwd_set function within the /ubus interface, allowing an attacker to manipulate password recovery mechanisms remotely. The weakness leads to insecure password recovery, potentially enabling unauthorized access. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The vendor was contacted but did not respond or provide a fix. Exploit details have been publicly disclosed, though no known exploits are reported in the wild at this time.

An attacker can remotely exploit this vulnerability to perform weak password recovery on the affected device, potentially leading to unauthorized access or control. The CVSS vector indicates the attack requires no privileges or user interaction and can be performed over the network, but the impact on confidentiality, integrity, and availability is limited to low or partial.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official Netcore channels for updates. Until a fix is available, consider restricting network access to the /ubus interface if possible to reduce exposure.