Yyycl

**Name of the Vulnerable Software and Affected Versions** Netcore NAP930 version 0.1.241010.141410 **Description** Remote OS command injection is possible within the Network Tools CGI component. The issue exists in the `eval()` function of the '/www/cgi-bin/network tools' endpoint, where improper handling of the `sid` variable allows an attacker to execute arbitrary operating system commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/www/cgi-bin/network tools' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Netcore NAP930 version 0.1.241010.141410 **Description** An issue exists in the Backup/Restore component within the `/lib/functions/backup common.sh` file. The manipulation of the `aes pass` argument leads to the use of a hard-coded cryptographic key, which can be exploited remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR289-GE version 1.4.5102 **Description** A stack-based buffer overflow exists in the Authentication component within the `password-check()` function of the `/bin/boa` file. This issue allows a remote attacker to trigger the overflow by manipulating the `Username` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the Authentication component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Netcore NR289-GE version 1.4.5102 **Description** An OS command injection flaw exists in the Location Time Handler component. The issue occurs when the `mac` argument is manipulated within the `system()` function of the '/location time.cgi' endpoint, allowing for remote exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR289-GE version 1.4.5102 **Description** An OS command injection flaw exists in the CGI Handler component. A remote attacker can exploit this by manipulating the `ntp ip` argument within the `/set ntp server ip.cgi` endpoint, which affects the system function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `ntp ip` argument in the `/set ntp server ip.cgi` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Netcore NR289-GE version 1.4.5102 **Description** A flaw in the `boa temp` Handler component allows remote attackers to bypass authentication. This issue occurs within the `process request()` function, enabling unauthorized access to be carried out remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `boa temp` Handler component to minimize the risk of exploitation.