CVE-2026-101074: fallo crítico en Netcore NR289-GE
Netcore NR289-GE Authentication boa password-check stack-based overflow
Publicada el
48Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 9.3epss 1.3%
probabilidad de explotación
1.3%top 30% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Executing a manipulation of the argument Username can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Productos afectados
Netcore · NR289-GEPoCs públicas encontradas — 1
cve_referencegithub.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_boa_stack_overflow.mdno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Netcore NR289-GE
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-101075CRITICALNetcore NR289-GE Location Time location_time.cgi system os command injectionEPSS 2.5%CVE-2026-101076CRITICALNetcore NR289-GE CGI set_ntp_server_ip.cgi system os command injectionEPSS 2.0%CVE-2026-101072CRITICALNetcore NR289-GE CGI ap_ip.cgi system os command injectionEPSS 2.0%CVE-2026-101077CRITICALNetcore NR289-GE boa_temp process_request missing authenticationEPSS 0.7%CVE-2026-101073MEDIUMNetcore NR289-GE CGI Dispatcher boa improper authenticationEPSS 0.6%