CVE-2026-101076

10 CRITICALpublic exploit available

Published 2026-09-28 · Updated 2026-09-28

AI risk analysis

Summary: The vulnerability allows remote command injection through the manipulation of the ntp_ip argument in the /set_ntp_server_ip.cgi file, enabling attackers to execute arbitrary commands on the device.
Exploitability: Exploitation is relatively straightforward with a public exploit available, requiring only the ability to manipulate the ntp_ip argument remotely.
Blast radius: If exploited, this could lead to full compromise of the device, including data theft, denial of service, and further lateral movement within the network.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Netcore NR289-GE 1.4.5103 or later.

rcewebcgios-command-injection

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /set_ntp_server_ip.cgi of the component CGI Handler. The manipulation of the argument ntp_ip results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-77, CWE-78

Public exploit & PoC references

https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_set_ntp_server_ip_command_injection.md

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.