EUVD-2026-88317
GHSA-5577-c572-2j8c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable CGI parameter injected into system() gives low-complexity RCE (AV:N/AC:L/PR:N/UI:N) with full device C/I/A:H; scope unchanged as impact stays on the router.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /set_ntp_server_ip.cgi of the component CGI Handler. The manipulation of the argument ntp_ip results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers execute arbitrary shell commands on the router by supplying a crafted ntp_ip value to /set_ntp_server_ip.cgi. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) confirms no privileges or user interaction are needed, and the only real precondition is network reachability to the device's web management interface, so risk is highest where that interface is exposed to the WAN. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation of the /set_ntp_server_ip.cgi CGI handler on Netcore NR289-GE (firmware 1.4.5102); the attacker only needs network reachability to the router's web management interface and injects OS commands through the ntp_ip parameter. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA:H) describes an unauthenticated, low-complexity, network-reachable OS command injection yielding full compromise - the SC/SI/SA:H subsequent-system flags inflate the base to 9.3 but are questionable for a single-host router (impact is really confined to the device, so a scope-unchanged reading lands nearer ~9.8 on CVSS 3.1). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis - Netcore did not respond to the disclosure, so there is no fixed firmware version to cite, and administrators should treat the device as unpatchable until the vendor ships one. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Netcore NR289-GE devices running firmware 1.4.5102 and immediately block external access to their web management interfaces (e.g., TCP ports 80 and 443) at the network perimeter; disable remote administration and change any default credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A command injection vulnerability (CVSS 9.8). Risk factors: public PoC available.
Plaintext daemon credentials in IDC SFX2100 routing config files (zebra, bgpd, ospfd, ripd). CVSS 10.0. PoC available.
Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stem
Kede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated r
RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure o
Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege aut
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operatin
OS command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) allows an attacker who can reach the
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today