| عنوان | Netcore磊科 Router Firmware NR289-GE_V1.4.5102 Missing Authentication |
|---|
| الوصف | An unauthenticated file write vulnerability (CWE-306, missing authentication on a critical function) was identified in the Netcore NR289-GE SMB router / AC controller, firmware version V1.4.5102 (Linux 2.6.36, MIPS32r2 big-endian, Realtek RTL8198C+RTL8370 platform). Note: the written paths are fixed (NOT attacker-controlled); the attacker fully controls only the content, making this an arbitrary-content write to two fixed staging files.
The vendor-patched boa web server (/bin/boa, running as root) streams the body of any POST request whose path contains "update"/"upgrade" into the firmware staging file /tmp/boa_temp.update, and any POST whose path contains "para_recover" into the config staging file /tmp/boa_temp.para (process_request POST branch @ 0x407dc4; sinks at 0x407e04 / 0x407e20). No authentication, size limit or content validation is performed; the HTTP response is typically 404 (no matching static file), but the file is already written - execution must be judged by the file, not the response. Combined with the separately reported boa whitelist flaw (any URI containing ".ico" skips Basic authentication), this is fully unauthenticated.
Proof of concept:
Step 1 - write firmware staging file (no credentials):
POST /x.ico/firmware_upgrade
Body: FIRMWARE-TEST-1234567890
Result on device: /tmp/boa_temp.update contains exactly FIRMWARE-TEST-1234567890
Step 2 - write config staging file (no credentials):
POST /x.ico/para_recover
Body: CONFIG-PAYLOAD-TEST
Result on device: /tmp/boa_temp.para contains exactly CONFIG-PAYLOAD-TEST
Consumption chain: /tmp/boa_temp.update feeds the firmware/AP upgrade flow (upload_ap_upgrade_cgi runs system("mv /tmp/boa_temp.update /tmp/upgrade"); upgrade images are RSA/checksum-verified per check_ap_upgrade_checksum, bounding the impact there). /tmp/boa_temp.para feeds the config-restore flow: put_parame_file_cgi (0x4bcfd4, itself reachable via the .ico bypass) converts it into /tmp/param.file.bak with only a strncmp against the model string "NR289-GE" as a header check, so a crafted configuration blob (including web credentials) can be planted into the restore channel.
The vulnerability was dynamically verified against the firmware emulated with qemu-mips user-mode emulation; arbitrary POST bodies were written to both staging files without any credentials. |
|---|
| المصدر | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_unauth_file_write.md |
|---|
| المستخدم | yyycl (UID 100580) |
|---|
| ارسال | 14/08/2026 02:08 PM (1 شهر منذ) |
|---|
| الاعتدال | 27/09/2026 07:48 PM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 410948 [Netcore NR289-GE 1.4.5102 boa_temp process_request توثيق ضعيف] |
|---|
| النقاط | 20 |
|---|