Summary
A missing authorization vulnerability in the Netcore NBR100V2 ACL Handler exposes the uci.apply function through an unauthenticated RPC configuration. A remote attacker may manipulate request data, including the section argument, to perform actions without the authorization checks normally required.
Affected context
The vulnerability affects Netcore NBR100V2 version 1.3.240614.030928 where the ACL definition for the RPC service permits unauthenticated access to uci.apply. Risk depends on whether the exposed function can modify router configuration or invoke privileged operations without an independent authorization layer.
Exploit preconditions
- Attack surface: Network-accessible RPC or management interface
- Required access: Ability to reach the exposed unauthenticated endpoint; valid credentials may not be required
- Trigger point: Invocation of the
uci.applyfunction through the ACL Handler - Manipulated input: Request parameters such as the
sectionargument - Why exploitation is possible: The endpoint can process a sensitive operation without consistently verifying whether the caller is authorized to perform it
Why this happens
The root cause is an authorization enforcement gap in the ACL configuration for the uci.apply RPC function. By allowing an unauthenticated caller to reach a privileged configuration operation, the implementation fails to enforce authorization at the point where the sensitive action is performed. This maps primarily to CWE-862: Missing Authorization and is also related to CWE-863: Incorrect Authorization, because access control behavior may not correctly distinguish permitted and unpermitted callers.
Potential impact
- An unauthenticated remote attacker may alter device configuration
- Network routing, firewall, or service settings could be changed
- The device could become unavailable or operate outside intended policy
- Security controls may be weakened or bypassed
- Compromised configuration could support further network intrusion
General mitigation guidance
Mitigation generally focuses on enforcing authorization independently of client-supplied ACL exposure and validating permissions at every sensitive operation.
Common defensive patterns include:
- Removing unauthenticated access to configuration-changing RPC methods
- Applying explicit deny-by-default rules to management interfaces
- Enforcing authentication and authorization at the service and function layers
- Validating the target section and permitted operations against the caller's privilege
- Separating read-only and configuration-changing APIs
- Running management services with the minimum privileges necessary
- Restricting administrative interfaces to trusted networks where possible
How teams detect issues like this
Organizations can detect similar authorization flaws through:
- Static analysis and configuration checks for unauthenticated exposure of privileged RPC methods
- Code review searches for sensitive handlers that lack caller or role validation
- Tests that invoke management functions as anonymous, low-privilege, and authorized users
- Policy checks requiring authentication for configuration-changing operations
- Runtime monitoring for unexpected unauthenticated calls to administrative endpoints
- Automated security review tools that identify missing or inconsistent authorization checks
