CVE-2026-101075: Netcore Router Command Injection
TL;DR - CVE-2026-101075 is a CVSS 10.0 remote OS command-injection flaw in Netcore NR289-GE firmware 1.4.5102. - Public exploit material exists; active exploitation is not confirmed and no fixed firmware was identified. - Remove affected routers from Internet exposure, restrict management access, and seek vendor guidance or replace unsupported devices.
Vulnerability at a Glance
| Field | Details |
|---|---|
| CVE ID | CVE-2026-101075 |
| Affected product | Netcore NR289-GE router |
| Affected firmware | 1.4.5102, also identified in public research as V1.4.5102, build/date notation 2018.06.1418_44 |
| CVSS score | 10.0 Critical |
| CVSS vector | Not supplied in the reviewed NVD record |
| Attack vector | Network, remotely exploitable according to the vulnerability description |
| Authentication required | Unknown; the reviewed record does not state whether authentication is required |
| Vulnerability type | OS command injection |
| Patch available | No vendor-confirmed fixed version identified |
| Public PoC or exploit material | Yes, a GitHub research reference is listed and the NVD description states that the exploit was publicly disclosed |
| Active exploitation | Not confirmed in the reviewed sources |
| CISA KEV status | Not listed |
CVE-2026-101075 affects a router firmware component that processes location and time-related functionality. The available record assigns the issue a maximum-severity CVSS base score of 10.0 and states that remote exploitation is possible. Internet-exposed devices therefore warrant immediate attention, even though the exact authentication requirements and CVSS vector were not provided.
The absence of a confirmed fixed firmware version changes the operational response. Administrators should not assume that any later firmware resolves the issue unless Netcore or the equipment supplier explicitly confirms the fix. Where supported remediation is unavailable, isolation or replacement is the safer control.
Analyst’s Take: Treat Internet exposure as the first decision point, not the absence of a KEV listing. The device is remotely exploitable, public exploit material exists, and no vendor-confirmed fixed version was identified. Those facts support containment while teams verify firmware and seek vendor guidance.
What Is This Vulnerability?
The vulnerable functionality is the Location Time Handler exposed through:
/location_time.cgi
The NVD description identifies the affected function as system and the vulnerable input as the mac argument. Manipulating that argument can lead to OS command injection. In practical terms, attacker-controlled data may be interpreted as operating-system instructions rather than treated solely as a MAC-address value.
The record says that remote exploitation is possible, but it does not document the exact request format, authentication prerequisites, privilege context, or command execution environment. Validate those details against the referenced research before attempting any testing. Defenders should nevertheless treat the issue as capable of arbitrary command execution on the router because command injection can allow an attacker to invoke tools, alter configuration, create persistence, or launch outbound connections.
A compromised router can become a strategic foothold. Potential consequences include DNS or traffic redirection, unauthorized port forwarding, firewall changes, credential collection, disruption of connectivity, and access to systems reachable from the device. These are plausible consequences of successful OS command injection, not confirmed activities attributed to this CVE.
For background, see this glossary explanation of broken access control and distinguish access-control issues from the command-injection flaw described here.
Who Is Affected?
The reviewed vulnerability records specifically identify the Netcore NR289-GE router running firmware 1.4.5102. Public research identifies the device more specifically as Netcore NR289-GE V1.4.5102, with the notation 2018.06.1418_44 in the reference path.
No broader affected-version range was provided in the reviewed NVD material. It is not safe to conclude that all NR289-GE firmware versions are affected, but it is equally unsafe to conclude that other versions are unaffected without vendor confirmation. Inventory teams should record the exact firmware string, hardware revision, deployment location, WAN exposure, and management configuration for every matching device.
Prioritize routers with a public IP address, WAN-exposed administrative services, or connectivity to sensitive internal networks. Small offices and unmanaged branch deployments may be difficult to identify because consumer and SMB routers are often absent from formal asset inventories.
CVSS Score Breakdown
CVE-2026-101075 has a reported CVSS base score of 10.0, Critical. The available NVD response did not include the CVSS vector string, so the individual metric selections cannot be independently reconstructed from the supplied record. The record does not establish the precise values for attack complexity, privileges required, user interaction, scope, or the confidentiality, integrity, and availability impact metrics.
The score is consistent with the description of a remotely exploitable command-injection vulnerability with potentially broad impact. Successful command execution on a router could affect device integrity and availability and could expose or alter network traffic. Defenders should avoid treating an inferred vector as authoritative. The missing vector and unknown authentication requirement are evidence gaps that should be resolved through vendor documentation, direct product testing in an isolated environment, or an updated vulnerability record.
For prioritization, the practical risk remains high: the device is network-facing by design, the reported severity is maximum, public exploit material exists, and no confirmed patch was identified. CISA KEV does not currently list this CVE, but KEV absence is not an assurance that exploitation cannot occur.
Exploitation Status
Public disclosure is confirmed by the NVD description, which states that the exploit has been disclosed publicly and may be used. The CVE record also includes a GitHub reference titled Netcore_NR289-GE_location_time_command_injection.md. This supports the conclusion that technical exploit or proof-of-concept material is publicly referenced.
The reviewed evidence does not independently confirm active exploitation in the wild. CVE-2026-101075 is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no reliable campaign, malware family, or incident report was identified in the supplied sources. KEV status is one signal rather than a guarantee of safety, particularly for Internet-exposed edge devices.
Public material can be copied and adapted even without a documented campaign. Monitoring should begin immediately rather than waiting for a KEV listing or vendor bulletin.
How to Detect It
Start with asset discovery. Search configuration-management databases, ISP inventories, network scanning results, DHCP records, and router management platforms for Netcore NR289-GE devices. Confirm the running firmware through the administrative interface or an approved management protocol. Record whether WAN administration is enabled and whether the device exposes the vulnerable CGI path externally.
Review web access logs and upstream firewall telemetry for requests involving /location_time.cgi, especially requests that include a mac parameter. The following pattern is a starting point for web-server, reverse-proxy, or network sensor searches; it is intentionally focused on detection rather than exploit construction:
/location_time\.cgi(?:\?|/)[^ ]*\bmac=
Look for unusual encoded metacharacters, shell keywords, repeated requests from the same source, unexpected HTTP methods, or requests followed by outbound connections from the router. A generic SIEM query might resemble:
http.request.uri contains "/location_time.cgi"
and http.request.uri contains "mac="
| stats count, values(src_ip), values(user_agent)
by destination_ip, bin(_time, 5m)
| where count >= 3
The exact field names depend on the SIEM and log source. Many embedded routers provide limited logging, and the absence of a matching event does not demonstrate that exploitation did not occur. Correlate gateway events with DNS changes, new port-forwarding rules, altered firewall policy, unexpected administrator accounts, firmware changes, and unexplained outbound traffic.
Technical Notes
Useful indicators include:
- Requests to
/location_time.cgicontaining amacparameter from untrusted networks - Bursts of requests against the same router or management address
- Unexpected DNS resolver or gateway changes
- New inbound forwarding rules
- Router reboots or configuration changes outside maintenance windows
- Outbound connections from the router to unfamiliar external addresses
If compromise is suspected, preserve logs and configuration backups before resetting the device. Treat credentials used through or stored on the router as potentially exposed.
Mitigation and Patching
No vendor-confirmed fixed version was identified in the reviewed sources. The affected version is 1.4.5102, and the available material does not provide a supported upgrade target. Do not claim that an unspecified later release fixes the vulnerability. Contact Netcore or the equipment supplier and request written confirmation of the remediation version and supported upgrade procedure.
Until confirmation is available, remove the router from direct Internet exposure where possible. Disable WAN-side administration, limit management access to a trusted administrative VLAN or VPN, and apply upstream filtering to prevent untrusted systems from reaching the device. If the router must remain in service, restrict access to the vulnerable management surface according to the device’s supported controls and monitor for attempts against it.
Organizations replacing unsupported edge devices can also review this comparison of secure web gateways for 2026 when evaluating broader network-security controls. A secure gateway does not patch the router, but it may provide additional segmentation, filtering, and monitoring while remediation is underway.
Technical Notes
A generic Linux firewall control can block external access to the router’s HTTP management service, but administrators must replace the example interface, source network, and port with values appropriate to their environment:
sudo nft add rule inet filter input iifname "wan0" tcp dport 80 ip saddr != 192.0.2.0/24 drop
sudo nft add rule inet filter input iifname "wan0" tcp dport 443 ip saddr != 192.0.2.0/24 drop
This is an upstream or host-firewall example, not a confirmed Netcore configuration command. Verify the rule in a maintenance window because incorrect filtering can disconnect remote management or break required services.
After containment, rotate router administrator credentials and any credentials reused on systems reachable through the router. Organizations that need a managed password-storage workflow may consider Try 1Password → for securely storing unique administrative credentials, subject to their security and procurement requirements.
If the router cannot enforce equivalent restrictions and no supported firmware is available, replace it with a supported device.
After containment, review DNS, NAT, firewall, VPN, and remote-management settings for unauthorized changes. If the device cannot be verified as clean, factory reset it only after preserving evidence and then rebuild its configuration from a trusted baseline.
References
The primary vulnerability description and severity information are available through the NVD record for CVE-2026-101075. The record identifies the Netcore NR289-GE firmware 1.4.5102, the /location_time.cgi Location Time Handler, the mac argument, remote exploitability, and public exploit disclosure.
The public research reference and vulnerability database entries are:
| Source | URL |
|---|---|
| GitHub research reference | https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_location_time_command_injection.md |
| VulDB CVE record | https://vuldb.com/cve/CVE-2026-101075 |
| VulDB vulnerability entry | https://vuldb.com/vuln/410946 |
| VulDB CTI reference | https://vuldb.com/vuln/410946/cti |
| CISA Known Exploited Vulnerabilities catalog | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
CISA KEV status should be checked again during remediation because catalog status can change after publication. At the time covered by this article, CVE-2026-101075 was not listed, active exploitation was not confirmed, and no fixed firmware version was identified.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.