CVE-2026-101072 is a critical (CVSS 10.0) OS command injection in the Netcore NR289-GE router, firmware 1.4.5102, in the ap_ip.cgi handler. The record says the vendor did not respond to disclosure. No fix is listed, so take the device off untrusted networks and plan to replace it.
What's affected
The record names the Netcore NR289-GE, firmware 1.4.5102, and the /ap_ip.cgi CGI handler, where the ip argument is not safely handled.
The record says the vendor was contacted early but did not respond. No fixed version is listed.
How to check if you're exposed
There is no package manager entry for this, so check the device itself.
- Search your inventory for the Netcore NR289-GE. The record names firmware 1.4.5102.
- Confirm the model and firmware from the label or the admin page.
- Check whether the management interface can be reached from the internet or from untrusted networks, for example with a scan of your own public address space.
What to do now
- Do not expose the device's web management interface to the internet. Restrict it to a trusted management network.
- If the device is internet facing today, take it off until you have a plan. There is no vendor fix to apply.
- Plan a replacement with a supported model, and set a date.
- Put the device in its own network segment so a compromise cannot reach internal systems.
- Watch the record and the vendor's site for a firmware release, and check any advisory before you trust it.
Why it matters
The weakness is OS command injection, filed as CWE-78 with its parent class CWE-77: input from a request ends up in a command that the operating system runs. Here the record says no privileges are needed and the attack is remote, which is how the vector reaches a 10.0.
The record says an exploit is publicly available. It does not claim attacks in the wild, and KEV is false.
A second Netcore flaw on the same firmware, CVE-2026-101077, covers missing authentication. Together they are a good reason to treat the device as untrusted.
Quick check
Does this need a login?
The vector says no privileges are required. Do not rely on the admin password to protect an exposed device.
Sources
Last reviewed: 19 October 2026.
