A critical buffer overflow vulnerability in Netcore NBR200V2 routers allows for remote code execution by authenticated attackers, posing a severe threat to network infrastructure.

This is a memory corruption vulnerability (CWE-120) triggered by improper handling of the wan_num argument within the /usr/bin/routerd binary. The vulnerability is exploitable by any authenticated user over the network.

The CVSS score of 9.9 reflects the extreme severity of this flaw, as it grants an attacker full control over the affected router. Successful exploitation could lead to total compromise of network traffic, unauthorized access to internal resources, and significant disruption of business operations. Given that the vendor has not provided a response or patch, the risk of persistent, undetected compromise is high.

Immediate Action: Since no official patch is available, restrict access to the device management interface to trusted administrative networks only, and disable remote management features if they are not strictly required.

Proactive Monitoring: Inspect system logs for unusual crash events related to the routerd service and monitor network traffic for unexpected patterns originating from internal management segments.

Compensating Controls: Deploy a Web Application Firewall or intrusion detection rules to inspect incoming requests for malformed parameters targeting the wan_num argument, providing a virtual patch layer.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced security research documentation.

Given the critical CVSS severity and the presence of a public proof-of-concept, users of the Netcore NBR200V2 must prioritize isolating these devices from untrusted network segments immediately. Because no vendor-supplied fix is currently available, organizations should consider these devices high-risk and implement strict network-level segmentation until the manufacturer releases a firmware update.