CVE-2026-101074: falha crítica em Netcore NR289-GE
Netcore NR289-GE Authentication boa password-check stack-based overflow
Publicada em
48Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 9.3epss 1.3%
probabilidade de exploração
1.3%top 30% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Executing a manipulation of the argument Username can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
Netcore · NR289-GEPoCs públicas encontradas — 1
cve_referencegithub.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_boa_stack_overflow.mdnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Netcore NR289-GE
No mesmo produto, das mais perigosas para as menos.
CVE-2026-101075CRITICALNetcore NR289-GE Location Time location_time.cgi system os command injectionEPSS 2.5%CVE-2026-101076CRITICALNetcore NR289-GE CGI set_ntp_server_ip.cgi system os command injectionEPSS 2.0%CVE-2026-101072CRITICALNetcore NR289-GE CGI ap_ip.cgi system os command injectionEPSS 2.0%CVE-2026-101077CRITICALNetcore NR289-GE boa_temp process_request missing authenticationEPSS 0.7%CVE-2026-101073MEDIUMNetcore NR289-GE CGI Dispatcher boa improper authenticationEPSS 0.6%