| Title | Netcore磊科 Router Firmware NR289-GE_V1.4.5102 Missing Authentication |
|---|
| Description | An unauthenticated file write vulnerability (CWE-306, missing authentication on a critical function) was identified in the Netcore NR289-GE SMB router / AC controller, firmware version V1.4.5102 (Linux 2.6.36, MIPS32r2 big-endian, Realtek RTL8198C+RTL8370 platform). Note: the written paths are fixed (NOT attacker-controlled); the attacker fully controls only the content, making this an arbitrary-content write to two fixed staging files.
The vendor-patched boa web server (/bin/boa, running as root) streams the body of any POST request whose path contains "update"/"upgrade" into the firmware staging file /tmp/boa_temp.update, and any POST whose path contains "para_recover" into the config staging file /tmp/boa_temp.para (process_request POST branch @ 0x407dc4; sinks at 0x407e04 / 0x407e20). No authentication, size limit or content validation is performed; the HTTP response is typically 404 (no matching static file), but the file is already written - execution must be judged by the file, not the response. Combined with the separately reported boa whitelist flaw (any URI containing ".ico" skips Basic authentication), this is fully unauthenticated.
Proof of concept:
Step 1 - write firmware staging file (no credentials):
POST /x.ico/firmware_upgrade
Body: FIRMWARE-TEST-1234567890
Result on device: /tmp/boa_temp.update contains exactly FIRMWARE-TEST-1234567890
Step 2 - write config staging file (no credentials):
POST /x.ico/para_recover
Body: CONFIG-PAYLOAD-TEST
Result on device: /tmp/boa_temp.para contains exactly CONFIG-PAYLOAD-TEST
Consumption chain: /tmp/boa_temp.update feeds the firmware/AP upgrade flow (upload_ap_upgrade_cgi runs system("mv /tmp/boa_temp.update /tmp/upgrade"); upgrade images are RSA/checksum-verified per check_ap_upgrade_checksum, bounding the impact there). /tmp/boa_temp.para feeds the config-restore flow: put_parame_file_cgi (0x4bcfd4, itself reachable via the .ico bypass) converts it into /tmp/param.file.bak with only a strncmp against the model string "NR289-GE" as a header check, so a crafted configuration blob (including web credentials) can be planted into the restore channel.
The vulnerability was dynamically verified against the firmware emulated with qemu-mips user-mode emulation; arbitrary POST bodies were written to both staging files without any credentials. |
|---|
| Source | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_unauth_file_write.md |
|---|
| User | yyycl (UID 100580) |
|---|
| Submission | 08/14/2026 14:08 (1 month ago) |
|---|
| Moderation | 09/27/2026 19:48 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 410948 [Netcore NR289-GE 1.4.5102 boa_temp process_request missing authentication] |
|---|
| Points | 20 |
|---|