A flaw in the ACL Handler package of Netcore NBR100V2 allows an attacker to manipulate the argument section of the uci.apply function through the unauthenticated.json configuration file. Because the function does not enforce proper authorization checks, a remote actor can bypass ACL restrictions and change configuration settings that should otherwise be protected. This uplifts an attacker’s privileges to modify device behavior, potentially affecting the confidentiality, integrity, or availability of the router and the services it exposes.

The vulnerability applies to Netcore NBR100V2 firmware version 1.3.240614.030928. No other affected versions are listed.

The CVSS score of 10 indicates catastrophic impact, and the score demonstrates the complexity of the exploit is low with no specialized conditions. The EPSS score is not available, but the vulnerability is publicly disclosed and can be triggered remotely, as stated in the description. The case has not yet been listed in CISA KEV, but the absence of a KEV listing does not diminish the risk because the condition remains exploitable over the internet by any actor capable of reaching the RPCD service. The likely attack vector involves sending crafted RPC calls that manipulate the uci.apply function, exploiting the missing authorization check to apply arbitrary configuration changes.