CVE-2026-101077: Netcore NR289-GE boa_temp process_request missing authentication
A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function processrequest of the component boatemp Handler. This manipulation causes missing authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Netcore NR289-GE devices running version 1.4.5102 are identified as affected. The issue is reachable remotely in the boa_temp Handler's process_request function.
Does exploitation require an account or user interaction?
No. The supplied vector indicates network access, low attack complexity, no privileges, and no user interaction are required.
What is the likely impact of successful exploitation?
The vulnerability is rated critical and can affect confidentiality, integrity, and availability at high impact. Its scope is listed as changed.
Is public exploitation information available?
Yes. An exploit has been published and may be used.
Is a vendor fix or response documented?
No vendor response is documented in the provided information. The vendor was contacted early but did not respond.