CVE-2026-101074 in NR289-GE
Summary
by MITRE • 09/28/2026
A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Executing a manipulation of the argument Username can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The Netcore NR289-GE router, specifically running firmware version 1.4.5102, contains a critical security flaw within its authentication subsystem that poses significant risks to network integrity and user privacy. The vulnerability resides in the password-check function located within the /bin/boa binary file, which serves as the embedded web server responsible for handling administrative interface requests. This component is central to the device's operation, managing login attempts and credential validation for users accessing the router’s configuration panel. Due to its exposure through the network interface, this service represents a high-value target for attackers seeking unauthorized access or control over the connected infrastructure.
The core technical flaw is identified as a stack-based buffer overflow, classified under CWE-121 in industry standard vulnerability taxonomies. This type of memory corruption occurs when the application writes more data to a fixed-length block of memory on the call stack than it can hold. In this specific instance, the manipulation of the Username argument passed during authentication allows an attacker to exceed the allocated buffer size. Because the input is not properly validated or sanitized before being copied into the stack-allocated variable, excessive length in the username field overwrites adjacent memory locations. This overwrite capability extends beyond simple data corruption and can allow for arbitrary code execution if the attacker carefully crafts the payload to overwrite return addresses or function pointers on the stack.
The operational impact of this vulnerability is severe due to its remote exploitability. Since the affected boa web server component listens on network interfaces, an adversary does not need physical access or prior authentication credentials to launch an attack. By sending a specially crafted HTTP request with an oversized username field, a threat actor can trigger the buffer overflow condition remotely over TCP/IP networks. The availability of public exploits significantly lowers the barrier to entry for malicious actors, enabling automated scanning and exploitation campaigns across vulnerable devices globally. Successful exploitation typically results in complete system compromise, allowing attackers to execute arbitrary commands with the privileges of the web server process, which often runs as root on embedded Linux systems.
This vulnerability aligns closely with MITRE ATT&CK techniques related to initial access and execution via network services. Specifically, it facilitates remote code execution through a service that is designed for administrative management but lacks sufficient input validation controls. The lack of response from the vendor regarding this disclosure exacerbates the risk profile, leaving deployed devices without official patches or mitigation guidance. Organizations relying on these routers must assume they are actively targeted by automated botnets and threat actors leveraging known exploits to gain footholds in local networks.
Mitigation strategies for this vulnerability require immediate action given the absence of a vendor patch. Network administrators should restrict access to the router’s web interface using firewall rules, limiting exposure only to trusted IP addresses or management VLANs where possible. Disabling remote administration features entirely is another effective control if administrative tasks can be performed locally. Additionally, implementing intrusion detection systems with signatures for known buffer overflow attempts targeting embedded web servers can provide an additional layer of defense. Long-term resolution involves replacing affected hardware with models from vendors that maintain active security support and timely patch cycles to address such critical flaws in authentication mechanisms.