{"id":"CVE-2026-101076","published":"2026-09-28T16:17:11.947","lastModified":"2026-09-28T21:02:16.150","description":"A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /set_ntp_server_ip.cgi of the component CGI Handler. The manipulation of the argument ntp_ip results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_set_ntp_server_ip_command_injection.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-101076","tags":[]},{"url":"https://vuldb.com/submit/929204","tags":[]},{"url":"https://vuldb.com/vuln/410947","tags":[]},{"url":"https://vuldb.com/vuln/410947/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_set_ntp_server_ip_command_injection.md","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows remote command injection through the manipulation of the ntp_ip argument in the /set_ntp_server_ip.cgi file, enabling attackers to execute arbitrary commands on the device.","exploitability":"Exploitation is relatively straightforward with a public exploit available, requiring only the ability to manipulate the ntp_ip argument remotely.","blast_radius":"If exploited, this could lead to full compromise of the device, including data theft, denial of service, and further lateral movement within the network.","remediation":"Upgrade to Netcore NR289-GE 1.4.5103 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","cgi","os-command-injection"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-29T08:48:04.409Z"}}