| Title | Netcore磊科 Router Firmware NR289-GE_V1.4.5102 Command Injection |
|---|
| Description | An unauthenticated command injection vulnerability (CWE-78) was identified in the Netcore NR289-GE SMB router / AC controller, firmware version V1.4.5102 (Linux 2.6.36, MIPS32r2 big-endian, Realtek RTL8198C+RTL8370 platform).
The web stack (patched boa -> /web/cgi-bin/cgitest.cgi, running as root) dispatches ap_ip.cgi to ap_ip_cgi (0x41aa74), which sets the IP configuration of a managed AP. The handler takes the user-controlled "ip" form field (likewise "mask" and "gateway") and, via set_ap_ip (0x435d70) and send_wget_set_command (0x4353c0, code 0x300006), embeds it into a shell command executed by system() without any input validation or sanitization:
sprintf(cmd, "/bin/wget_1 ... --post-data \"mode_name=netcore_set&conntype=0&lan_ip=%s&lan_mask=%s&default_gw=%s&CurrentApp=lan\" \"http://%s/cgi-bin-igd/netcore_set.cgi\" > /tmp/status", ip, mask, gw, ap_ip);
system(cmd); // cgitest.cgi @ 0x435540
Because the value lands inside double quotes, an "ip" value such as ";CMD;# breaks out of the quoted string and injects an arbitrary OS command, which executes with root privileges and leads to full compromise of the device.
Exploitation conditions: (1) the "mac" form field's first 6 bytes must match an entry of the AC's bound-AP list (/tmp/para/bind_list_table) - i.e. the device is managing at least one AP, its normal operating state; (2) no authentication is required when the request URI contains the substring ".ico", due to a separate boa whitelist flaw (strstr(uri,".ico") at boa @ 0x407438, reported separately). Field note: the ip field is copied with a 20-byte unterminated strncpy, so the usable command budget is ~12 characters inside ";CMD;# ; longer commands can be staged across multiple requests, and the sibling endpoint location_time.cgi (reported separately) has no such limit. After the injected command runs the CGI response may be empty/aborted - execution must be judged by side effects, not by the HTTP response.
Proof of concept (no credentials):
POST /x.ico/ap_ip.cgi
Body: mac=AA%3ABB%3ACC%3ADD%3AEE%3AFF&ip=%22%3Becho%20ok%3E%2Ftmp%2Fp%3B%23&mask=1&gateway=1
(URL-decoded ip: ";echo ok>/tmp/p;# ; mac first 6 bytes must match a bound AP)
The file /tmp/p on the device then contains: ok
The same unsanitized pattern exists in sibling handlers in the same binary, all converging on send_wget_set_command: location_time.cgi (mac, no length limit), set_ntp_server_ip.cgi (ntp_ip), ac_ip_config_set.cgi (acserver_ip) and wifi_lamp.cgi (mac).
The vulnerability was dynamically verified against the firmware emulated with qemu-mips user-mode emulation; the injected command was executed with root privileges.
|
|---|
| Source | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_ap_ip_command_injection.md |
|---|
| User | llsss (UID 96233) |
|---|
| Submission | 08/14/2026 13:45 (1 month ago) |
|---|
| Moderation | 09/27/2026 19:48 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 410943 [Netcore NR289-GE 1.4.5102 CGI /ap_ip.cgi system ip os command injection] |
|---|
| Points | 20 |
|---|