CVE-2026-101075

Executive Summary

CVE-2026-101075 is a critical OS command injection vulnerability in the Netcore NR289-GE router, firmware version 1.4.5102. The flaw resides in the /location_time.cgi component's system function, where manipulation of the mac argument allows a remote, unauthenticated attacker to execute arbitrary operating system commands on the underlying device. With a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and a publicly disclosed exploit with no vendor patch, this vulnerability poses an immediate, maximum-severity risk to any internet-exposed NR289-GE device.

Technical Analysis

The Netcore NR289-GE is a commercially deployed wireless router. Firmware version 1.4.5102 contains a command injection weakness (CWE-77: Improper Neutralization of Special Elements used in a Command) within the Location Time Handler component. Specifically, the vulnerability is located in the system function of /location_time.cgi.

The attack vector operates as follows: the mac argument supplied to /location_time.cgi is passed into an OS command executed by the system function without adequate sanitization or escaping of shell metacharacters. An attacker who can reach the CGI endpoint can inject shell control operators (such as ;, |, &&, or backticks) into the mac parameter. Because the argument is not neutralized before being concatenated into a command string, the injected operators cause the underlying operating system shell to execute attacker-supplied commands in addition to (or instead of) the intended command.

Key technical characteristics derived strictly from the available description:

• Vulnerability class: OS command injection (CWE-77).
• Affected component: Location Time Handler.
• Affected file/endpoint: /location_time.cgi.
• Vulnerable function: system (the code path that invokes the OS shell).
• Injection parameter: mac.
• Preconditions: Network reachability to the CGI endpoint; no authentication, privileges, or user interaction are required (PR:N/UI:N).
• Scope: The CVSS scope is marked Changed (S:C), indicating the exploited component can impact resources beyond its own security authority — consistent with command injection granting control over the host operating system.

No public proof-of-concept or exploit code was identified in the tracked sources, and no Nuclei template exists. The precise sanitization routine and the exact command string being built are not disclosed in the available data; therefore, this analysis remains at the vulnerability-class level and does not assert specific internal implementation details beyond the function, file, and parameter named in the disclosure.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (OS command injection in a CGI handler) and the disclosed facts. No public PoC is available; specific payload construction is described at the vulnerability-class level only.

1. Reconnaissance / Target Identification. The attacker identifies internet-exposed Netcore NR289-GE devices, for example by fingerprinting the device on Shodan using product:"Netcore NR289-GE" or by detecting the presence of the /location_time.cgi endpoint and the NR289-GE interface. Because the vulnerability is remotely exploitable with no authentication, any host that exposes the management/CGI interface is a candidate.

2. Triggering the Flaw. The attacker sends a crafted HTTP request to the /location_time.cgi endpoint, supplying a malicious value in the mac argument. The injection is triggered because the mac value is incorporated into a command executed by the system function without neutralization of shell metacharacters.

3. Payload / Execution Method (class-level). The attacker embeds shell control operators within the mac argument so that, when the value is interpreted by the shell inside the system call, additional attacker-controlled commands are executed. At the class level, this is standard command injection: an unsanitized parameter is concatenated into a shell command, allowing arbitrary commands to run with the privileges of the CGI/web process (typically root on embedded router firmware).

4. Post-Exploitation Impact. Because the CVSS vector rates Confidentiality, Integrity, and Availability as High with Changed Scope, successful exploitation yields full compromise of the device. An attacker could read or modify device configuration, alter routing/DNS behavior, establish persistence, pivot into the local network behind the router, or co-opt the device into a botnet. Given that the exploit has been disclosed publicly and the vendor did not respond or provide a patch, opportunistic mass exploitation is a realistic near-term outcome.

Impact Assessment

CVE-2026-101075 carries a CVSS 3.1 base score of 10.0, the maximum possible severity. The subscores reflect a worst-case profile:

• AV:N (Network): Exploitable remotely over the network.
• AC:L (Low): No special conditions or race windows required.
• PR:N (None): No credentials or privileges needed.
• UI:N (None): No victim interaction required.
• S:C (Changed): The exploited CGI component can affect the underlying OS and beyond its intended security scope.
• C:H / I:H / A:H: Complete loss of confidentiality, integrity, and availability.

Business impact: An unauthenticated remote attacker achieving arbitrary OS command execution on an edge router can intercept or redirect traffic, tamper with DNS, disable network services, and use the device as a foothold to reach internal systems. For SMB and branch deployments where the NR289-GE acts as the network perimeter, this represents total perimeter compromise.

Blast radius: Every Netcore NR289-GE device running firmware 1.4.5102 that exposes the affected CGI interface to an untrusted network. There is no published affected-version list beyond the identified version, no vendor fix, and no workaround from the vendor. CISA KEV status is NO, and no EPSS score has been published by FIRST.org at the time of writing; however, the public disclosure of an exploit materially raises the likelihood of active exploitation.

Detection Guidance

Sigma Rule

title: Netcore NR289-GE OS Command Injection via location_time.cgi
id: 6f2a1c4e-1010-75c0-9d3b-2026a1b2c3d4
status: experimental
description: Detects HTTP requests attempting OS command injection against the Netcore NR289-GE /location_time.cgi endpoint via the mac parameter.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101075
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/location_time.cgi'
  selection_injection:
    cs-uri-query|contains:
      - 'mac='
    cs-uri-query|re: '(?i)(mac=[^&]*(;|\||&&|`|\$\(|%3b|%7c|%26%26|%60))'
  condition: selection_endpoint and selection_injection
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate MAC address values that contain no shell metacharacters
level: critical
tags:
  - attack.t1190
  - cve.2026.101075

YARA Rule

rule CVE_2026_101075_Netcore_CommandInjection
{
    meta:
        description = "Detects OS command injection attempts targeting Netcore NR289-GE location_time.cgi via mac parameter"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101075"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $ep = "/location_time.cgi" ascii nocase
        $p1 = "mac=" ascii nocase
        $meta1 = ";" ascii
        $meta2 = "|" ascii
        $meta3 = "&&" ascii
        $meta4 = "`" ascii
        $meta5 = "$(" ascii
        $enc1 = "%3b" ascii nocase
        $enc2 = "%7c" ascii nocase
        $enc3 = "%26%26" ascii nocase
        $enc4 = "%60" ascii nocase

    condition:
        $ep and $p1 and any of ($meta*) or
        $ep and $p1 and any of ($enc*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101075 Netcore NR289-GE OS Command Injection via location_time.cgi mac parameter"; flow:established,to_server; http.uri; content:"/location_time.cgi"; http.uri; content:"mac="; http.uri; pcre:"/(mac=[^&]*(;|\||&&|`|\$\(|%3b|%7c|%26%26|%60))/i"; classtype:web-application-attack; reference:cve,2026-101075; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101075; sid:2026101075; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where network.protocol == "http" and url.path : "/location_time.cgi" and url.query : "mac="]
  [network where network.protocol == "http" and url.path : "/location_time.cgi" and url.query regex "mac=[^&]*(;|\\||&&|`|\\$\\(|%3b|%7c|%26%26|%60)"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=stream:http
| eval uri = coalesce(cs_uri_stem, uri_path, url)
| eval query = coalesce(cs_uri_query, uri_query, url_query)
| where like(uri, "%/location_time.cgi%")
| where like(lower(query), "%mac=%")
| regex query="(?i)mac=[^&]*(;|\||&&|`|\$\(|%3b|%7c|%26%26|%60)"
| stats count min(_time) as first_seen max(_time) as last_seen values(query) as payloads by src_ip, uri
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,cve_2026_101075,">
  <rule id="20261075" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>/location_time.cgi</match>
    <regex type="pcre2">mac=[^&]*(;|\||&amp;&amp;|`|\$\(|%3b|%7c|%26%26|%60)</regex>
    <description>CVE-2026-101075: Possible Netcore NR289-GE OS command injection attempt against location_time.cgi (mac parameter)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_101075,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, firmware update, or vendor advisory is available; the vendor was contacted early and did not respond.

1. Immediate mitigations:

   • Remove all Netcore NR289-GE management/CGI interfaces from internet exposure. Restrict access to a trusted management VLAN or via VPN only.
   • Place the device behind a firewall/WAF and block external access to /location_time.cgi specifically, and to the management interface generally.
   • If the device cannot be isolated and is not business-critical, consider decommissioning it until a fix is available.
   • Monitor web server/router logs for requests to /location_time.cgi containing shell metacharacters in the mac argument.

2. Patch / upgrade steps:

   • No vendor patch exists. Attempt to obtain a fixed firmware release from Netcore (the vendor did not respond to disclosure). Until then, treat all NR289-GE 1.4.5102 devices as fully compromised-capable and prioritize segmentation and compensating controls.
   • Track the NVD entry and any emerging vendor advisory for a remediation version.

3. Long-term hardening:

   • Enforce a policy that edge devices never expose administrative CGI endpoints to untrusted networks.
   • Adopt network segmentation to bound the blast radius (CVSS Scope: Changed) should a device be compromised.
   • Maintain an inventory of edge/router firmware versions and subscribe to vendor security notifications.
   • Apply egress filtering and DNS monitoring to detect router compromise (traffic redirection, unexpected outbound connections).

References

• NVD — CVE-2026-101075: https://nvd.nist.gov/vuln/detail/CVE-2026-101075
• CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection'): https://cwe.mitre.org/data/definitions/77.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Netcore vendor site (no security advisory published as of writing): https://www.netcore.in
• CISA KEV Catalog (CVE-2026-101075 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog