CVE-2026-101077 is a critical (CVSS 10.0) missing authentication flaw in the Netcore NR289-GE router, firmware 1.4.5102, in the boa_temp handler. The record says the vendor did not respond. No fix is listed, so take the device off untrusted networks and plan its replacement.
What's affected
The record names the Netcore NR289-GE, firmware 1.4.5102, and the process_request function of the boa_temp handler.
The vendor was contacted early and did not respond. No fixed version is listed.
How to check if you're exposed
There is no package manager entry for this, so check the device itself.
- Search your inventory for the Netcore NR289-GE. The record names firmware 1.4.5102.
- Confirm the model and firmware from the label or the admin page.
- Check whether the management interface can be reached from the internet or from untrusted networks, for example with a scan of your own public address space.
What to do now
- Do not expose the device's web management interface to the internet. Restrict it to a trusted management network.
- If the device is internet facing today, take it off until you have a plan. There is no vendor fix to apply.
- Plan a replacement with a supported model, and set a date.
- Put the device in its own network segment so a compromise cannot reach internal systems.
- Watch the record and the vendor's site for a firmware release, and check any advisory before you trust it.
Why it matters
The class is missing authentication for a critical function, filed under CWE-306 and the broader CWE-287 (improper authentication). A request that should require a login is simply accepted.
That is why the vector shows no privileges, no user interaction and a changed scope, giving 10.0.
The record says the exploit is published. It does not describe attacks in the wild and the KEV flag is false. See also CVE-2026-101072 for a command injection in the same firmware.
Quick check
What is the quickest risk reduction?
Remove the device from any network path the internet can reach, and block access to its management interface from everywhere except one trusted host.
Sources
Last reviewed: 19 October 2026.
