Nr289 Ge
Monthly
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and abuse its process_request function to write arbitrary files, leading to full device compromise with high confidentiality, integrity, and availability impact (CVSS 4.0 score 9.3, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw affects firmware version 1.4.5102, and publicly available exploit code exists - a GitHub proof-of-concept demonstrating unauthenticated arbitrary file write against the NR289-GE V1.4.5102 web interface. No CISA KEV listing was provided; the vendor was contacted early but did not respond, and no vendor patch has been identified at time of analysis.
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers execute arbitrary shell commands on the router by supplying a crafted ntp_ip value to /set_ntp_server_ip.cgi. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) confirms no privileges or user interaction are needed, and the only real precondition is network reachability to the device's web management interface, so risk is highest where that interface is exposed to the WAN. Publicly available exploit code exists (linked from the VulDB disclosure and hosted on GitHub), but there is no CISA KEV entry, so active exploitation is not confirmed; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary commands on the router via the 'mac' parameter of the /location_time.cgi Location Time Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no patch is available at this time. The primary limiting factor is exposure: the web management interface is typically LAN-facing by default, so internet-wide exploitation depends on remote management being exposed to untrusted networks.
Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker corrupt memory in the boa web server's pre-authentication password-check routine by manipulating the Username argument, with high impact to confidentiality, integrity, and availability consistent with remote code execution. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor patch is available. Risk is highest where the device's HTTP administration interface is reachable beyond a trusted LAN, such as when remote management is enabled on WAN.
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can reach the device's /ap_ip.cgi CGI handler execute arbitrary shell commands on the underlying operating system, with CVSS v4.0 scored 9.3 and all three impact metrics (confidentiality, integrity, availability) rated High. No authentication or user interaction is required - stated by the CVSS vector PR:N/UI:N and confirmed by our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - so the only prerequisite is network reachability of the router's web service, which is LAN-bound by default but internet-facing whenever remote administration is enabled. Publicly available exploit code exists (a detailed proof-of-concept for the ap_ip command injection is published in a public GitHub repository), and the vendor was contacted but did not respond, so at the time of analysis there is no vendor fix and the practical exposure is limited only by how widely each deployment exposes the management interface.
Improper authentication in the /bin/boa CGI dispatcher of Netcore NR289-GE firmware 1.4.5102 allows unauthenticated remote attackers to bypass credential checks on the router's web management interface, with low impact across confidentiality, integrity, and availability per both the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) and our assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Publicly available exploit code exists, including a GitHub write-up documenting the authentication bypass, so exploitation is a practical concern wherever the management interface is reachable - typically the LAN, or the WAN when remote administration is explicitly enabled (not default on most consumer routers). No vendor response was received and no vendor-released patch was identified at time of analysis. EPSS data was not provided; CISA KEV status is not indicated, so this is not confirmed actively exploited, but the presence of released exploit code and the low attack complexity make the exposure meaningful for any internet-facing or remotely-administered device.
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and abuse its process_request function to write arbitrary files, leading to full device compromise with high confidentiality, integrity, and availability impact (CVSS 4.0 score 9.3, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw affects firmware version 1.4.5102, and publicly available exploit code exists - a GitHub proof-of-concept demonstrating unauthenticated arbitrary file write against the NR289-GE V1.4.5102 web interface. No CISA KEV listing was provided; the vendor was contacted early but did not respond, and no vendor patch has been identified at time of analysis.
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers execute arbitrary shell commands on the router by supplying a crafted ntp_ip value to /set_ntp_server_ip.cgi. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) confirms no privileges or user interaction are needed, and the only real precondition is network reachability to the device's web management interface, so risk is highest where that interface is exposed to the WAN. Publicly available exploit code exists (linked from the VulDB disclosure and hosted on GitHub), but there is no CISA KEV entry, so active exploitation is not confirmed; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary commands on the router via the 'mac' parameter of the /location_time.cgi Location Time Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no patch is available at this time. The primary limiting factor is exposure: the web management interface is typically LAN-facing by default, so internet-wide exploitation depends on remote management being exposed to untrusted networks.
Unauthenticated remote stack-based buffer overflow in the Netcore NR289-GE router (firmware 1.4.5102) lets an attacker corrupt memory in the boa web server's pre-authentication password-check routine by manipulating the Username argument, with high impact to confidentiality, integrity, and availability consistent with remote code execution. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor patch is available. Risk is highest where the device's HTTP administration interface is reachable beyond a trusted LAN, such as when remote management is enabled on WAN.
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can reach the device's /ap_ip.cgi CGI handler execute arbitrary shell commands on the underlying operating system, with CVSS v4.0 scored 9.3 and all three impact metrics (confidentiality, integrity, availability) rated High. No authentication or user interaction is required - stated by the CVSS vector PR:N/UI:N and confirmed by our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - so the only prerequisite is network reachability of the router's web service, which is LAN-bound by default but internet-facing whenever remote administration is enabled. Publicly available exploit code exists (a detailed proof-of-concept for the ap_ip command injection is published in a public GitHub repository), and the vendor was contacted but did not respond, so at the time of analysis there is no vendor fix and the practical exposure is limited only by how widely each deployment exposes the management interface.
Improper authentication in the /bin/boa CGI dispatcher of Netcore NR289-GE firmware 1.4.5102 allows unauthenticated remote attackers to bypass credential checks on the router's web management interface, with low impact across confidentiality, integrity, and availability per both the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) and our assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Publicly available exploit code exists, including a GitHub write-up documenting the authentication bypass, so exploitation is a practical concern wherever the management interface is reachable - typically the LAN, or the WAN when remote administration is explicitly enabled (not default on most consumer routers). No vendor response was received and no vendor-released patch was identified at time of analysis. EPSS data was not provided; CISA KEV status is not indicated, so this is not confirmed actively exploited, but the presence of released exploit code and the low attack complexity make the exposure meaningful for any internet-facing or remotely-administered device.