CVE-2026-101072

Executive Summary

CVE-2026-101072 is an OS command injection vulnerability in the Netcore NR289-GE router firmware version 1.4.5102. The flaw resides in the function system within the file /ap_ip.cgi of the CGI Handler component, where manipulation of the ip argument allows an unauthenticated remote attacker to execute arbitrary operating system commands. With a CVSS score of 10.0 and a publicly available exploit, this vulnerability poses a critical risk to all exposed Netcore NR289-GE devices, enabling full device compromise and potential lateral movement into connected networks. The vendor has not released a patch or responded to disclosure communications.

Technical Analysis

The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command) and manifests as OS command injection. According to the NVD description, the affected component is the CGI Handler within the Netcore NR289-GE firmware version 1.4.5102. The specific attack surface is the /ap_ip.cgi endpoint, which processes HTTP requests containing an ip argument. The vulnerable function is named system, indicating that user-supplied input from the ip argument is passed to a system shell call without adequate sanitization or validation. This allows an attacker to append or inject shell metacharacters (e.g., ;, |, &&) to the ip parameter, resulting in arbitrary command execution with the privileges of the CGI process. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H confirms that the attack is network-accessible, requires no authentication or user interaction, and has a scope change (S:C), meaning the compromise can affect resources beyond the vulnerable component. The impact to confidentiality, integrity, and availability is rated High. No further code-level details (e.g., exact input parsing logic) are provided in the NVD description; therefore, analysis is limited to the vulnerability class and the explicitly named function and file.

Exploitation Scenarios

The attack chain for CVE-2026-101072 can be described at the vulnerability-class level based on the NVD description:

1. Reconnaissance/Target Identification: An attacker scans the internet for Netcore NR289-GE devices. This can be done via Shodan using dorks such as product:"Netcore NR289-GE" or by identifying the /ap_ip.cgi endpoint through HTTP fingerprinting. Since the vulnerability is in a CGI handler, the device likely exposes an HTTP/HTTPS management interface on a public port (e.g., 80, 443, 8080).

2. Triggering the Flaw: The attacker sends a crafted HTTP request to the /ap_ip.cgi endpoint. The request includes the ip argument, which is processed by the system function without proper input validation. The attacker injects shell metacharacters into the ip value to break out of the intended command context.

3. Payload/Execution Method: By appending commands using shell operators (e.g., ;, |, &&), the attacker causes the underlying system call to execute arbitrary OS commands on the device. For example, a request like GET /ap_ip.cgi?ip=127.0.0.1;reboot (illustrative only, based on the described parameter and function) would execute the reboot command. No specific payload is provided in the NVD description; the exact syntax depends on how the ip argument is incorporated into the command string. The publicly available exploit (referenced in the NVD description but not included here) likely demonstrates a working payload.

4. Post-Exploitation Impact: Successful exploitation grants the attacker command execution with the privileges of the CGI process—typically root or a highly privileged user on embedded devices. This enables full control over the router: reading/modifying configuration, intercepting network traffic, establishing persistence, pivoting into the internal network, or recruiting the device into a botnet. The scope change (S:C) indicates that the attacker can affect other systems connected to the compromised router.

No public PoC is available in this dataset; however, the NVD description states the exploit is publicly available. The attack chain is inferred from the vulnerability class and the named function/file.

Impact Assessment

The impact of CVE-2026-101072 is critical. The CVSS score of 10.0 reflects the highest possible severity, driven by:

• Network attack vector (AV:N): Exploitable remotely over the internet.
• Low attack complexity (AC:L): No special conditions required.
• No privileges required (PR:N): Unauthenticated exploitation.
• No user interaction (UI:N): No victim action needed.
• Scope change (S:C): The vulnerability in the router can impact other components or networks.
• High confidentiality, integrity, and availability impact (C:H/I:H/A:H): Full loss of confidentiality, integrity, and availability on the device and potentially beyond.

Affected systems are Netcore NR289-GE routers running firmware version 1.4.5102. These devices are typically deployed as enterprise or SOHO gateways, making them high-value targets for initial access into corporate networks. The blast radius includes all devices directly exposed to the internet and any internal networks reachable from the compromised router. Given the public exploit and lack of patch, the risk of widespread exploitation is severe.

Detection Guidance

Sigma Rule

title: Netcore NR289-GE OS Command Injection via /ap_ip.cgi
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to /ap_ip.cgi with ip parameter containing shell metacharacters, indicative of CVE-2026-101072 exploitation.
author: Valters IT
date: 2026-01-01
logsource:
  category: webserver
  product: netcore
detection:
  selection:
    cs-uri-stem: '/ap_ip.cgi'
    cs-uri-query|contains:
      - 'ip='
  keywords:
    - ';'
    - '|'
    - '&&'
    - '`'
    - '$('
  condition: selection and keywords
falsepositives:
  - Legitimate use of special characters in ip parameter (unlikely)
level: critical

YARA Rule

rule CVE_2026_101072_Netcore_Command_Injection
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-101072 in HTTP requests to /ap_ip.cgi"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101072"
        severity = "critical"
    strings:
        $endpoint = "/ap_ip.cgi"
        $param = "ip="
        $shell1 = ";"
        $shell2 = "|"
        $shell3 = "&&"
        $shell4 = "`"
        $shell5 = "$("
    condition:
        $endpoint and $param and any of ($shell*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101072 Netcore NR289-GE OS Command Injection Attempt"; flow:to_server,established; content:"/ap_ip.cgi"; http_uri; content:"ip="; http_uri; pcre:"/ip=[^&]*(;|\||&&|`|\$\(|\$\{)/Ui"; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

sequence by host.id, source.ip with maxspan=5s
  [network where http.request.method == "GET" and url.path == "/ap_ip.cgi" and url.query contains "ip="]
  [network where url.query regex ".*(;|\\||&&|`|\\$\\().*"]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri="/ap_ip.cgi*" uri="*ip=*"
| regex uri="(;|\\||&&|`|\\$\\()"
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, uri, status
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100001" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/ap_ip.cgi</url>
    <regex>ip=.*[;&|`$()]</regex>
    <description>CVE-2026-101072: Netcore NR289-GE OS command injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Remove public internet exposure of the Netcore NR289-GE management interface. Restrict access to trusted internal networks via firewall rules or VPN.
   • If remote management is required, place the device behind a reverse proxy with strict input validation and WAF rules targeting /ap_ip.cgi and shell metacharacters.
   • Disable the CGI handler if not needed, or block requests to /ap_ip.cgi at the network perimeter.
   • Monitor for exploitation attempts using the detection rules provided above.

2. Patch/Upgrade Steps:

   • No patch is available. The vendor (Netcore) was contacted but did not respond. Continuously monitor the vendor's website and security advisories for firmware updates.
   • As a compensating control, consider replacing the device with an alternative product that receives security updates.

3. Long-Term Hardening:

   • Implement network segmentation to isolate IoT/embedded devices from critical assets.
   • Enforce strong authentication and disable unnecessary services on all network devices.
   • Conduct regular vulnerability scans and firmware audits for embedded devices.
   • Adopt a defense-in-depth strategy including egress filtering to prevent command-and-control traffic from compromised devices.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-101072
• CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'): https://cwe.mitre.org/data/definitions/77.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Vendor Website: https://www.netcore.in (no advisory available)
• CISA KEV: Not applicable (CVE not listed as of report date)