Llsss

**Name of the Vulnerable Software and Affected Versions** Netcore NR289-GE version 1.4.5102 **Description** An OS command injection flaw exists in the CGI Handler component. A remote attacker can exploit this by manipulating the `ip` argument within the `/ap ip.cgi` endpoint, which is processed by the `system()` function. OS command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `/ap ip.cgi` endpoint to minimize the risk of exploitation.

A security flaw has been discovered in Netcore NR289-GE 1.4.5102. Impacted is an unknown function of the file /bin/boa of the component CGI Dispatcher. Performing a manipulation results in improper authentication. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** Netcore NBR100V2 version 1.3.240614.030928 **Description** An authorization bypass exists in the ACL Handler component within the file `/usr/share/rpcd/acl.d/unauthenticated.json`. A remote attacker can manipulate the `section` argument of the `uci.apply()` function to perform unauthorized actions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `uci.apply()` function within the ACL Handler component.

**Name of the Vulnerable Software and Affected Versions** Netcore NBR200V2 version 1.3.241127.071246 **Description** An OS command injection flaw exists in the Web Management Interface component. A remote attacker can exploit this by manipulating the `QUERY STRING` argument passed to the `eval()` function within the `/www/cgi-bin/network tools` endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NBR200V2 version 1.3.241127.071246.071246 **Description** An OS command injection flaw exists in the Tools Ping Handler component. A remote attacker can trigger this issue by manipulating the `url` argument passed to the `system()` function within the `/usr/bin/network tools` file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.