CVE-2026-101188

Received Received - Intake

Weak Password Recovery in Netcore POWER13 Firmware

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description

A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-101188

Affected Vendors & Products

Vendor	Product	Version / Range
netcore	power13	2.0.240730.162638

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

Executive Summary

This vulnerability is in Netcore POWER13 version 2.0.240730.162638. It affects the function routerd.passwd_set in the file /ubus, allowing weak password recovery. The issue can be exploited remotely and has been publicly disclosed. The vendor did not respond to early disclosure attempts.

Impact Analysis

An attacker could exploit this to recover weak passwords, potentially gaining unauthorized access to the system. Since the attack is remote, it poses a risk even without physical access. Public disclosure means exploits may already exist.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements under GDPR and HIPAA. Weak password recovery may result in data breaches, triggering compliance violations and potential penalties.

Mitigation Strategies

Immediately update Netcore POWER13 to the latest patched version if available. If no patch exists, disable remote access to the routerd.passwd_set function and restrict network exposure. Monitor for unusual password recovery attempts or unauthorized access.

Hi! I’m here to help you understand CVE-2026-101188. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70