CVE-2026-101074

Executive Summary

CVE-2026-101074 is a critical stack-based buffer overflow (CWE-119) in Netcore NR289-GE firmware version 1.4.5102, located in the password-check function of the /bin/boa binary within the Authentication component. A remote, unauthenticated attacker can trigger the flaw by manipulating the Username argument, leading to memory corruption that may permit arbitrary code execution. With a CVSS v3.1 base score of 9.8 and a publicly available exploit, and with no vendor patch or response, affected devices remain fully exposed.

Technical Analysis

The vulnerability resides in the Boa web server component (/bin/boa) shipped within Netcore NR289-GE firmware 1.4.5102. Boa is a lightweight, single-tasking HTTP server commonly embedded in routers, gateways, and IoT/edge devices to expose administrative interfaces and CGI handlers. The specific weakness is a stack-based buffer overflow in the password-check function, triggered when the Username argument is supplied with overly long or malformed input.

Mechanism: during parsing of the authentication request, the Username value is copied into a fixed-size stack buffer without adequate bounds validation. Because the Username field is attacker-controlled and reaches the vulnerable copy operation before authentication is enforced, the overflow can be triggered pre-authentication. Overflowing the stack buffer corrupts adjacent stack memory, potentially overwriting a saved return address or canary-adjacent control data. This yields the classic memory-corruption primitive: a controllable write that can hijack control flow if the attacker crafts the payload to redirect execution.

Attack surface: The /bin/boa HTTP interface, typically listening on the device's LAN/WAN management ports (HTTP). Because the authentication component is reachable over the network, the attack vector is remote (AV:N) with no privileges (PR:N) and no user interaction (UI:N). The vulnerability class (CWE-119) is well understood and frequently leveraged on embedded firmware where stack protections such as stack canaries, ASLR, and NX may be absent or weakly applied. The vendor did not respond to disclosure, meaning the vulnerable password-check logic remains in the shipping firmware.

No public proof-of-concept code, Nuclei template, or exploit artifact has been observed in this dataset; however, the NVD description states the exploit "has been made available to the public," indicating weaponization likely exists.

Exploitation Scenarios

Because a public exploit is reported and the vendor has not patched, the following attack chain is described at the vulnerability-class level based STRICTLY on the NVD description.

1. Reconnaissance / target identification: An attacker scans for exposed Netcore NR289-GE management interfaces. Fingerprinting can use Shodan or active probes against the Boa web server banner and device-specific HTTP responses. Targets are devices reachable over the network exposing the Boa administrative surface.

2. Triggering the flaw: The attacker issues a crafted HTTP request to the authentication handler in /bin/boa, supplying an oversized Username argument. The password-check function copies this argument into a fixed stack buffer without bounds checking, overflowing adjacent stack memory. Because the flaw is reachable during authentication processing, no valid credentials are required.

3. Payload / execution: At the vulnerability-class level, a stack-based buffer overflow allows an attacker to overwrite stack-resident control data (e.g., a saved return address) and redirect execution. Depending on the device's mitigations and architecture, an attacker may crash the service or achieve code execution by supplying a crafted payload via the Username argument. No public PoC is available in this dataset, so the precise payload construction is not documented here.

4. Post-exploitation impact: Successful exploitation yields high confidentiality, integrity, and availability impact (C:H/I:H/A:H). An attacker could execute arbitrary code in the context of the Boa process, potentially gaining persistence on the device, harvesting credentials, pivoting into the LAN, or disabling the device (DoS via crash). The unpatched state means repeated attempts are feasible.

Impact Assessment

Business impact is severe. A CVSS v3.1 base score of 9.8 reflects network-reachable, unauthenticated, low-complexity exploitation with total loss of confidentiality, integrity, and availability. Affected systems are Netcore NR289-GE devices running firmware 1.4.5102, commonly deployed as SOHO/enterprise edge gateways or routers. Blast radius includes any network segment where the management interface is reachable, whether over WAN or LAN. Because no patch exists and the vendor is unresponsive, devices remain exposed indefinitely. If the device is internet-facing, mass exploitation is plausible given the public exploit availability; if internal, lateral movement and persistence risk are elevated. Availability impact includes denial of service from a crash of the Boa process.

Detection Guidance

Sigma Rule

title: Netcore NR289-GE Boa Username Stack Buffer Overflow Attempt
id: 7c1e9a52-3b4d-4f0a-9d21-8e6f0c2a1b77
status: experimental
description: Detects oversized Username values submitted to the Boa authentication handler on Netcore NR289-GE devices, indicative of CVE-2026-101074 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101074
author: SOC Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: boa
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - '/login'
      - '/auth'
      - '/cgi-bin'
  selection_username:
    cs-uri-query|contains: 'Username='
  condition: selection_method and selection_uri and selection_username
  timeframe: 5m
falsepositives:
  - Legitimate long usernames (unlikely)
level: critical

YARA Rule

rule CVE_2026_101074_Netcore_Boa_Overflow
{
    meta:
        description = "Detects suspicious oversized Username authentication attempts targeting Netcore NR289-GE Boa (CVE-2026-101074)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101074"
        author = "SOC Threat Intelligence"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $u = "Username=" ascii nocase
        $login = "login" ascii nocase
        $auth = "auth" ascii nocase
        $repeat = /Username=[A-Za-z0-9]{200,}/ ascii
    condition:
        $u and ($repeat or ($login or $auth)) and filesize < 50KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101074 Netcore NR289-GE Boa Username Stack Buffer Overflow Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"login"; http.request_body; content:"Username="; pcre:"/Username=[A-Za-z0-9._%+-]{200,}/i"; classtype:attempted-admin; sid:10107401; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "POST" and url.path : ("*login*", "*auth*", "*cgi-bin*")]
  [network where http.request.body.content : "Username=*" and length(http.request.body.content) > 128]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=boa
| eval userfield=coalesce(form_data, uri_query, _raw)
| where match(userfield, "(?i)Username=[A-Za-z0-9._%+-]{200,}")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, http_user_agent
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="netcore,boa,web,">
  <rule id="101074" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>Username=</match>
    <regex type="pcre2">Username=[A-Za-z0-9._%+-]{200,}</regex>
    <description>CVE-2026-101074: Possible Netcore NR289-GE Boa Username stack buffer overflow exploitation attempt.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,pci_dss_6.5.2,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Disable or restrict public exposure of the Boa administrative interface; block WAN access to management ports via firewall ACLs. Restrict management access to trusted IPs through network segmentation. Where possible, disable remote management and change default ports. Monitor for crash/restart anomalies in the Boa service as evidence of exploitation attempts.

2. Patch / upgrade: No vendor patch is available. The vendor was contacted but did not respond. Monitor Netcore advisories and firmware release channels for NR289-GE updates beyond 1.4.5102; if none are forthcoming, treat devices as end-of-life and plan replacement.

3. Long-term hardening: Replace affected devices if no fix is delivered. Enforce least-privilege network access, deploy IDS/IPS signatures (above) for detection, and apply egress/inbound filtering. Maintain an asset inventory to identify all NR289-GE instances and prioritize compensating controls.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-101074
• CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer — https://cwe.mitre.org/data/definitions/119.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• Netcore vendor site (monitor for advisory; no response received during disclosure) — https://www.netcore.com
• CISA KEV catalog — not listed (checked; no exploitation-in-the-wild entry at time of writing) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog