CVE-2026-101075

10 CRITICALpublic exploit available

Published 2026-09-28 · Updated 2026-09-28

AI risk analysis

Summary: The flaw allows os command injection via the mac argument in the /location_time.cgi file, enabling remote code execution.
Exploitability: Exploitation is relatively straightforward with a public exploit available. The attacker needs network access to the affected device.
Blast radius: If exploited, the vulnerability could lead to complete control of the device, potentially leading to data theft or network compromise.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Netcore NR289-GE 1.4.5102 or later.

rceos-command-injectionwebremote-exploitable

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /location_time.cgi of the component Location Time Handler. The manipulation of the argument mac leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-77, CWE-78

Public exploit & PoC references

https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_location_time_command_injection.md

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.