CVE-2026-101188: Netcore POWER13 ubus routerd.passwd_set password recovery
A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwdset of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be performed remotely and requires no privileges or user interaction, according to the supplied vector. A publicly disclosed exploit may be available for use.
Which deployments are known to be affected?
The affected product identified is Netcore POWER13 version 2.0.240730.162638. The provided data does not state whether other versions or default configurations are affected.
What is the impact of successful exploitation?
Manipulation of the routerd.passwd_set function in /ubus can lead to weak password recovery. The supplied severity vector indicates potential low-impact confidentiality, integrity, and availability effects, with scope changed.
Is a vendor fix or workaround available?
No fix or workaround is provided in the available information. The vendor was contacted but did not respond, so administrators should treat the public exploit disclosure as a relevant exposure factor.