Basic Information

• Vendor: Netcore
• Vendor Website: https://www.netcoretec.com/service-support/support
• Model: NBR200V2
• Firmware Version: V1.3.241127.071246
• Firmware Download: https://www.netcoretec.com/service-support/download/firmware/2705.html
• Affected Component: /usr/bin/routerd

Description

Netcore NBR200V2 firmware V1.3.241127.071246 contains a remotely triggerable buffer overflow in vlan_load_form_uci(). The firmware exposes uci write operations for the network configuration and also exposes routerd.wan_num_set over /ubus. By remotely planting an oversized named switch_vlan section in the network configuration and then invoking the WAN-number reconfiguration logic, an attacker can force vlan_load_form_uci() to copy the overlong section name into a heap allocation with only 36 bytes of remaining space. This can crash the process or, with a crafted payload, lead to arbitrary code execution through heap corruption.

Technical Details

Vulnerability chain:

1. The method table exposes wan_num_set:

object.name = "routerd";
...
"wan_num_set" -> sub_415364

1. sub_415364 parses the wan_num field and invokes do_wan_num_set():

blobmsg_parse(&off_42FD1C, 1, v11, a5 + 4, (v6 & 0xFFFFFF) - 4);
...
v9 = _bswapsi2(*v7);
if ( v9 - 1 < 4 )
    result = do_wan_num_set(v9);

The parsed policy name is:

0x41b88c -> "wan_num"

1. do_wan_num_set() forwards control into multi_wan_config():

if ( multi_wan_config(a1) >= 0 )
{
    ...
}

1. multi_wan_config() loads VLAN state through vlan_load_form_uci():