Netcore NR289-GE vulnerabilities

A security flaw has been discovered in Netcore NR289-GE 1.4.5102. It affects an unknown function in the file /bin/boa of the CGI Dispatcher component. Manipulation results in improper authentication. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted but did not respond.

A missing authentication vulnerability has been found in Netcore NR289-GE version 1.4.5102 in the function process_request of the boa_temp Handler component. The attack can be carried out remotely. The exploit is public, and the vendor did not respond.

An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /set_ntp_server_ip.cgi (CGI Handler component). Manipulation of the argument ntp_ip allows remote command execution. The exploit is public, and the vendor did not respond.

An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /location_time.cgi (Location Time Handler component). Manipulation of the argument mac allows remote command execution. The exploit is public, and the vendor did not respond.

A stack-based buffer overflow vulnerability has been identified in Netcore NR289-GE version 1.4.5102 in the password-check function of the file /bin/boa (Authentication component). Manipulation of the argument Username allows remote attack. The exploit is public, and the vendor did not respond.

A vulnerability was identified in Netcore NR289-GE 1.4.5102 in the system function of the file /ap_ip.cgi of the CGI Handler component. Manipulation of the argument ip leads to OS command injection. The attack can be launched remotely, and the exploit is publicly available.