The Netcore NBR200V2 router is susceptible to a remote buffer overflow attack that can lead to full system compromise by an authenticated user.

This vulnerability involves a buffer overflow in the wan_config_set_vlan function within the /usr/bin/routerd binary, which can be triggered by manipulating the vlan_wanX.ports argument. The attack requires low privileges, meaning an authenticated user can exploit this flaw to achieve remote code execution.

The CVSS score of 9.9 reflects the critical nature of this vulnerability, as it allows for complete loss of confidentiality, integrity, and availability. Successful exploitation grants an attacker full control over the network device, which could be used as a pivot point to compromise internal network segments, intercept sensitive traffic, or cause significant operational disruption.

Immediate Action: Since no official patch is currently available from the vendor, restrict management interface access to trusted IP addresses only and disable unnecessary WAN configuration features.

Proactive Monitoring: Monitor system logs for repeated crashes of the routerd process or anomalous traffic patterns originating from internal user accounts directed at the WAN configuration interface.

Compensating Controls: Implement strict network segmentation and utilize a firewall or Intrusion Prevention System to inspect traffic directed at the router management interface for malformed vlan_wanX.ports parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked research write-up.

Due to the critical severity and the existence of a public proof-of-concept, users should treat this vulnerability with the highest priority. If the affected device cannot be isolated or replaced, network administrators must enforce strict access controls on the management interface immediately to prevent unauthorized exploitation by authenticated users.