CVE-2026-101072

Name of the Vulnerable Software and Affected Versions Netcore NR289-GE version 1.4.5102

Description An OS command injection flaw exists in the CGI Handler component. A remote attacker can exploit this by manipulating the ip argument within the /ap ip.cgi endpoint, which is processed by the system() function. OS command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the /ap ip.cgi endpoint to minimize the risk of exploitation.