CVE-2026-101072
CriticalCVSS 10.0Summary
A vulnerability was identified in Netcore NR289-GE 1.4.5102 in the system function of the file /ap_ip.cgi of the CGI Handler component. Manipulation of the argument ip leads to OS command injection. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
An attacker can remotely execute arbitrary system commands on the device, potentially leading to full device and network compromise.
Recommendation
Immediately restrict access to the device, apply vendor patches, or consider replacing the device with a more secure one.
Other vulnerabilities in Netcore NR289-GE
See all- CVE-2026-101073High
A security flaw has been discovered in Netcore NR289-GE 1.4.5102. It affects an unknown function in the file /bin/boa of the CGI Dispatcher component. Manipulation results in improper authentication. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted but did not respond.
- CVE-2026-101077Critical
A missing authentication vulnerability has been found in Netcore NR289-GE version 1.4.5102 in the function process_request of the boa_temp Handler component. The attack can be carried out remotely. The exploit is public, and the vendor did not respond.
- CVE-2026-101076Critical
An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /set_ntp_server_ip.cgi (CGI Handler component). Manipulation of the argument ntp_ip allows remote command execution. The exploit is public, and the vendor did not respond.
- CVE-2026-101075Critical
An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /location_time.cgi (Location Time Handler component). Manipulation of the argument mac allows remote command execution. The exploit is public, and the vendor did not respond.
- CVE-2026-101074Critical
A stack-based buffer overflow vulnerability has been identified in Netcore NR289-GE version 1.4.5102 in the password-check function of the file /bin/boa (Authentication component). Manipulation of the argument Username allows remote attack. The exploit is public, and the vendor did not respond.
Original NVD description (English source)
A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS