Basic Information

• Vendor: Netcore
• Vendor Website: https://www.netcoretec.com/service-support/support
• Model: NBR200V2
• Firmware Version: V1.3.241127.071246
• Firmware Download: https://www.netcoretec.com/service-support/download/firmware/2705.html
• Affected Component: /usr/bin/routerd

Description

Netcore NBR200V2 firmware V1.3.241127.071246 contains a remotely triggerable buffer overflow in the WAN VLAN reconfiguration path. The firmware exposes both the routerd.wan_config_set ubus method and the uci ubus object for the network configuration. By first storing a crafted network.vlan_wanX.ports string and then invoking the WAN configuration handler, a remote attacker can drive the router into wan_config_set_vlan() and then set_ports_type(), where an unbounded strcat() writes into a 32-byte stack buffer. This can crash the process or, with a carefully shaped payload, lead to code execution.

Technical Details

Vulnerability chain:

1. The router exposes the configuration entry point:

object.name = "routerd";
object.methods = off_42F814;
"wan_config_set" -> sub_416E34

1. sub_416E34 parses a large WAN configuration message. If proto is not supplied, it still reaches the public WAN update path:

blobmsg_parse(&off_42FEBC, 38, v126, a5 + 4, (v6 & 0xFFFFFF) - 4);
...
if ( !v126[3] )
{
    wan_config_set_public(0, &v88);
    delay_network_reload();
}

1. wan_config_set_public() always calls wan_config_set_vlan() at the end of the WAN update:

wan_config_set_vlan((int *)a2);

1. wan_config_set_vlan() uses a 32-byte stack destination and passes it to set_ports_type():

_DWORD v20[8]; // 32 bytes
...
set_ports_type((char *)v18, (char *)v20, 1);
...
set_ports_type((char *)v18, (char *)v20, 0);

1. set_ports_type() performs unbounded concatenation into the caller-provided buffer: