Your Router Has No Passport Control: The CVSS 10.0 Flaws Hitting Small Business Networks Right Now
Five vulnerabilities scored CVSS 10.0 were published against small business networking equipment in the last 24 hours. The exploits are already public. No authentication is required to use them.
That is not a drill. That is the threat picture as of this morning.
What Has Actually Been Published
The National Institute of Standards and Technology’s National Vulnerability Database published eight critical vulnerabilities yesterday and overnight. Five of them score CVSS 10.0, the highest possible severity rating. The majority target a single device: the Netcore NBR200V2, a budget router and gateway commonly found in small business networks across the UK and Asia.
Here is what the Netcore flaws actually do, without the vendor marketing language:
CVE-2026-94097 (CVSS 10.0): The CGI diagnostic endpoint accepts a parameter called param, key, or val. An attacker can inject operating system commands through that parameter. Remotely. Without logging in. The exploit is public.
CVE-2026-94095 (CVSS 9.9): The traceroute diagnostic feature accepts a URL argument. Feed it a crafted string and you can execute arbitrary commands on the device. Remotely. Exploit is public.
CVE-2026-94096 (CVSS 9.9): The LAN IP configuration handler accepts an IPv4 argument. Same problem. Command injection. Remote. Public exploit.
CVE-2026-94099 (CVSS 9.9): The backup and restore function processes a query string parameter. Inject commands there too. Remote. Public exploit.
CVE-2026-94100 (CVSS 9.9): The WAN VLAN reconfiguration function has a buffer overflow in the argument handling for VLAN port assignments. Remote exploitation. Public exploit.
That is five separate attack paths on the same device. Any one of them is sufficient to give an attacker full control of your network boundary.
The D-Link DIR-868L is the second device in the crosshairs. CVE-2026-94089 (CVSS 10.0) targets the authentication handler itself. The strcpy function in the login CGI processes the id and password arguments without bounds checking. An attacker can send a crafted request and overflow the stack. Remote. Unauthenticated. Exploit is public.
Why This Matters More Than the CVSS Score Suggests
A CVSS 10.0 on a router is categorically different from a CVSS 10.0 on application software.
Your router is the front door. Everything on your network sits behind it. Customer data. Financial records. Email. Remote access tokens. The devices your staff use to connect to your cloud systems. If an attacker owns the router, they do not need to breach anything else. They are already inside, watching everything.
Command injection on a network device means an attacker can run whatever they want on the operating system. They can create accounts. Disable logging. Redirect traffic. Set up persistent access that survives reboots. Exfiltrate data. Redirect your DNS queries so your staff end up on credential-harvesting sites instead of legitimate services.
Buffer overflow in an authentication handler is arguably worse. The attack surface is the login page itself. Every device on the internet can reach that. You do not need to find an authenticated session to exploit it.
There is one more detail worth noting. The NVD disclosure records state that Netcore’s vendor was contacted early about these vulnerabilities and did not respond. That is the vendor’s position on your security. Take it at face value.
The CrowdSec Offboarding Failure: A Different Kind of Lesson
Separate from the router vulnerabilities, a story from this week illustrates a second threat that is, if anything, more common in small businesses.
CrowdSec, a French security company, disclosed that on 22 May an attacker copied approximately 170 of its private GitHub repositories. The attack vector was a compromised npm package in the TanStack ecosystem that contained a GitHub token. The token belonged to a former employee whose access had not been revoked after they left the company.
The attacker used that token, obtained from a poisoned open-source package, to authenticate to GitHub as the former employee and exfiltrate private code repositories.
This is a supply chain attack combined with an offboarding failure. The specific technical mechanism, a malicious npm package, is not something most small businesses encounter directly. But the underlying failure is universal: an ex-employee’s access credentials remained active long after they had left the building.
Small businesses are particularly exposed here. There is rarely a formal offboarding checklist. Access reviews are infrequent or nonexistent. When someone leaves, the conversation is usually about returning the laptop, not about auditing every cloud service, SaaS platform, shared inbox, and API token associated with their account.
The data is consistent on this point. The ICO’s breach reports regularly include incidents where former employee credentials were used to access systems weeks or months after departure. It is not exotic. It is routine.
How to Use This as a Competitive Differentiator
Clients and prospective clients are increasingly asking about security posture during procurement conversations. Being able to provide concrete, evidence-based answers is a differentiator.
If you can confirm that your network boundary devices are patched and inventoried, and that your offboarding process includes a documented access revocation checklist, you are ahead of the majority of businesses your size. Not by a wide margin, but enough to matter when a procurement officer is comparing you against a competitor who cannot answer the same questions.
Cyber Essentials certification requires that boundary devices are patched and that access is controlled. If you are pursuing or maintaining that certification, the router vulnerabilities disclosed this week are directly relevant to your compliance position. Your assessor will ask about patch status. Have the answer ready.
Making the Business Case
Three arguments that will hold up in a board or management discussion:
First, the exploits are already public. This is not a theoretical future risk. Proof-of-concept code for these vulnerabilities is available now. The window between disclosure and active exploitation in the wild is measured in days, sometimes hours. The question is not whether attackers will attempt to use these. It is whether your device will still be vulnerable when they do.
Second, router compromise is a force multiplier for attackers. A single compromised boundary device gives an attacker access to everything behind it. The cost of replacing or patching a router is trivial compared to the cost of a breach investigation, regulatory notification, and customer communication following a compromise of the data that router was protecting.
Third, the offboarding risk has a measurable precedent. CrowdSec lost access to 170 private code repositories through a single unrevoked token. For a small business, the equivalent is a former employee retaining access to your CRM, your cloud storage, or your email system. The ICO does not consider the size of the organisation a mitigating factor when assessing enforcement action.
What to Do This Week
1. Identify your boundary devices. Log in to your router or ask your IT provider to confirm the make, model, and current firmware version of every device sitting between your network and the internet. If you do not know, that is the first problem to fix.
2. Check patch availability and apply it. For Netcore NBR200V2 and D-Link DIR-868L devices specifically, check the vendor’s support pages for firmware updates addressing these CVEs. If patches are not yet available, or if the vendor has not responded to the disclosure, discuss with your IT provider whether network isolation or device replacement is appropriate.
3. Restrict management interface access. If your router’s web management interface is accessible from the public internet, restrict it immediately. Management access should only be possible from your internal network or a specific administrative IP range. This does not patch the vulnerability, but it reduces the attack surface significantly while you arrange a proper fix.
4. Audit former employee access. Produce a list of everyone who has left your business in the last 12 months. For each person, confirm that their accounts have been disabled or deleted across every system they had access to: email, cloud storage, CRM, accounting software, any SaaS platform, VPN credentials, and any shared API tokens or service accounts. This is not a one-time exercise. It should be part of your standard offboarding procedure.
5. Ask your MSP for confirmation in writing. If you have a managed service provider, send them this briefing and ask them to confirm in writing the patch status of your boundary devices and the status of your access revocation process for recent leavers. A professional MSP should be able to answer both questions within 24 hours. If they cannot, that tells you something important about the quality of the service you are receiving.
Follow the podcast wherever you listen. If today’s briefing was useful, leave a rating or a review: it helps other business owners find the show. Drop a comment with what you found most relevant, and share this with someone who runs a business and probably has no idea what router is sitting between them and the internet.