CVE-2026-101076: Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection
A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /setntpserverip.cgi of the component CGI Handler. The manipulation of the argument ntpip results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be treated as exposed?
Netcore NR289-GE devices running version 1.4.5102 should be treated as affected. The vulnerable CGI endpoint is /set_ntp_server_ip.cgi.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction.
How urgent is remediation?
Remediation should be prioritized because public exploit code is available and the issue can result in remote OS command injection. The provided data does not identify a vendor fix or workaround, and notes that the vendor did not respond to early disclosure contact.