Description
A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file /lib/functions/backup_common.sh of the component Backup/Restore. This manipulation of the argument aes_pass causes use of hard-coded cryptographic key
. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-29
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cryptographic key compromise allowing decryption of backup data
Action: Assess Impact
AI Analysis

Impact

An attacker who can supply the aes_pass argument in the backup_common.sh script can force the router to use a hard‑coded AES key instead of a user‑supplied key. This loss of key confidentiality exposes the backup archives to decryption by anyone who can read the backups, thereby violating confidentiality. The flaw is documented as CWE‑320 and CWE‑321, highlighting the improper handling of sensitive information and the use of hard‑coded secrets.

Affected Systems

The vulnerability is limited to Netcore NAP930 devices running firmware version 0.1.241010.141410. No other versions or products are listed as affected.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered remotely, an attacker does not need local access; the exploit was publicly disclosed and could be used against any exposed device running the affected firmware.

Generated by OpenCVE AI on September 29, 2026 at 03:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the device to a firmware revision that eliminates the hard‑coded key or replaces it with a properly managed key.
  • If an upgrade is unavailable, reconfigure the backup utility to use a strong, randomly generated encryption key rather than the default value.
  • Disallow or tightly restrict remote initiation of backups if that feature is present, and closely monitor backup activity for unauthorized requests.
  • Contact Netcore to obtain a vendor‑issued fix; if no response is received, consider implementing a custom patch to enforce proper key usage.

Generated by OpenCVE AI on September 29, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 02:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file /lib/functions/backup_common.sh of the component Backup/Restore. This manipulation of the argument aes_pass causes use of hard-coded cryptographic key . It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title Netcore NAP930 Backup/Restore backup_common.sh hard-coded key
First Time appeared Netcore
Netcore nap930
Weaknesses CWE-320
CWE-321
CPEs cpe:2.3:a:netcore:nap930:*:*:*:*:*:*:*:*
Vendors & Products Netcore
Netcore nap930
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Netcore Nap930
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-01T15:30:21.371Z

Reserved: 2026-09-28T18:38:08.858Z

Link: CVE-2026-102241

cve-icon Vulnrichment

Updated: 2026-10-01T15:30:14.831Z

cve-icon NVD

Status : Deferred

Published: 2026-09-29T03:17:14.510

Modified: 2026-10-01T16:17:33.730

Link: CVE-2026-102241

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T13:19:38Z

Weaknesses