| Título | Netcore磊科 Router Firmware NR289-GE_V1.4.5102 Authentication Bypass Issues |
|---|
| Descrição | An authentication bypass vulnerability (CWE-287) was identified in the Netcore NR289-GE SMB router / AC controller, firmware version V1.4.5102 (Linux 2.6.36, MIPS32r2 big-endian, Realtek RTL8198C+RTL8370 platform).
The web management interface is served by a vendor-patched boa (/bin/boa, started by /bin/switch as "/bin/boa -p /web -f /var/boa.conf") running as root, which forwards every *.cgi request to a single management CGI (/web/cgi-bin/cgitest.cgi, 441 dispatch handlers). Access is protected by HTTP Basic authentication, but boa's built-in no-auth whitelist (whitelist walker at 0x407408, table at 0x410618) contains a fatal flaw: after enumerating the table, boa executes
strstr(uri, ".ico") != NULL -> request marked whitelisted // boa @ 0x407438
Any request whose decoded URI path contains the substring ".ico" therefore skips Basic authentication entirely (CUR_CHECK_NEED=2, set at boa 0x4076d4). Since CGI classification depends only on the URI ending in ".cgi" (not on file existence), a request such as
POST /x.ico/wan_config_set.cgi
reaches the corresponding management handler with no credentials. Moreover, the CGI-side permission gate (cgitest.cgi @ 0x4372f8) short-circuits when CUR_CHECK_NEED==2, so all 441 handlers - including 188 admin-only perm=1 set operations (WAN/LAN config, firewall, user management, logging) - are reachable unauthenticated.
Proof of concept:
Step 1 - control request without the bypass is rejected:
POST /ap_list_show.cgi
Response: HTTP/1.1 401 Unauthorized (WWW-Authenticate: Basic realm="netcore")
Step 2 - same handler via a URI containing ".ico", no Authorization header:
POST /x.ico/ap_list_show.cgi
Response: HTTP/1.1 200 OK, handler output
Combined with the command injection sinks in location_time.cgi / ap_ip.cgi (reported separately), this bypass leads to unauthenticated remote code execution with root privileges.
The vulnerability was dynamically verified against the firmware emulated with qemu-mips user-mode emulation; whitelisted-bypass requests reached management handlers without any credentials while identical requests without ".ico" were rejected with 401.
|
|---|
| Fonte | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_authentication_bypass.md |
|---|
| Utilizador | llsss (UID 96233) |
|---|
| Submissão | 14/08/2026 13h48 (há 1 mês) |
|---|
| Moderação | 27/09/2026 19h48 (1 month later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 410944 [Netcore NR289-GE 1.4.5102 CGI Dispatcher /bin/boa Autenticação fraca] |
|---|
| Pontos | 20 |
|---|