CVE-2026-101074: critical vulnerability in Netcore NR289-GE
Netcore NR289-GE Authentication boa password-check stack-based overflow
Published
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.3epss 1.3%
exploitation probability
1.3%top 30% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Executing a manipulation of the argument Username can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
Netcore · NR289-GEpublic PoCs found — 1
cve_referencegithub.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_boa_stack_overflow.mdunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Netcore NR289-GE
In the same product, most dangerous first.
CVE-2026-101075CRITICALNetcore NR289-GE Location Time location_time.cgi system os command injectionEPSS 2.5%CVE-2026-101076CRITICALNetcore NR289-GE CGI set_ntp_server_ip.cgi system os command injectionEPSS 2.0%CVE-2026-101072CRITICALNetcore NR289-GE CGI ap_ip.cgi system os command injectionEPSS 2.0%CVE-2026-101077CRITICALNetcore NR289-GE boa_temp process_request missing authenticationEPSS 0.7%CVE-2026-101073MEDIUMNetcore NR289-GE CGI Dispatcher boa improper authenticationEPSS 0.6%