The vulnerability CVE-2026-94101 affects Netcore NBR200V2 firmware version 1.3.241127.071246. It is a buffer overflow in the vlan_load_form_uci function of /usr/bin/routerd triggered by manipulating the wan_num argument. The flaw allows remote attackers to cause a buffer overflow condition, potentially leading to arbitrary code execution or denial of service. The exploit has been publicly disclosed, increasing the risk of exploitation. The vendor was notified but has not issued any response or patch.

Successful exploitation of this buffer overflow can allow remote attackers to execute arbitrary code or cause denial of service on the affected device. Given the critical CVSS score of 9.4 and the availability of public exploit code, this vulnerability poses a severe risk to affected systems. The lack of vendor response or patch increases exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider mitigating exposure by restricting remote access to the device, disabling vulnerable services if possible, or replacing the device with a secure alternative until a patch is available.