CVE-2026-101073 Overview
CVE-2026-101073 is an authentication bypass vulnerability affecting the Netcore NR289-GE router running firmware version 1.4.5102. The flaw resides in an unknown function of the /bin/boa binary, which serves as the CGI Dispatcher for the device's web management interface. Manipulation of requests to this component results in improper authentication [CWE-287], allowing remote attackers to interact with protected functionality without valid credentials. According to the public disclosure, exploit material has been released and the vendor did not respond to coordinated outreach, leaving affected devices exposed.
Critical Impact
Remote attackers can bypass authentication on Netcore NR289-GE routers over the network without user interaction, gaining access to device management functions normally restricted to administrators.
Affected Products
- Netcore NR289-GE Router
- Firmware version 1.4.5102 (build 2018.06.1418_44)
- /bin/boa CGI Dispatcher component
Discovery Timeline
- 2026-09-28 - CVE CVE-2026-101073 published to NVD
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-101073
Vulnerability Analysis
The vulnerability affects the boa web server binary that acts as a CGI dispatcher on the Netcore NR289-GE router. The dispatcher fails to properly enforce authentication checks before routing requests to protected handlers. An attacker who sends a crafted HTTP request to the management interface can reach functionality that should require valid session credentials.
The flaw is classified under [CWE-287: Improper Authentication]. Because the issue sits in the request dispatch layer rather than individual handlers, it potentially exposes a broad set of administrative endpoints behind the single bypass. The vendor has not responded to disclosure attempts, and no patch has been published.
Root Cause
The /bin/boa CGI Dispatcher does not consistently validate authentication tokens or session state before dispatching requests to CGI handlers. Attackers can manipulate request parameters or paths to reach protected routes while skipping the authentication check performed by the web interface.
Attack Vector
The attack is executed remotely over the network against the router's HTTP management interface. No prior privileges and no user interaction are required. Devices with the management interface exposed to the internet or reachable from untrusted network segments are at highest risk. A public exploit has been referenced in the disclosure materials.
Technical details are documented in the GitHub Authentication Bypass Exploit writeup and the VulDB CVE-2026-101073 Details page.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-101073
Indicators of Compromise
- Unauthenticated HTTP requests to CGI endpoints handled by /bin/boa originating from external or unexpected internal sources.
- Successful configuration changes, DNS modifications, or firmware updates on NR289-GE devices without a corresponding administrator login event.
- New or modified port forwarding, firewall rules, or administrative accounts on affected routers.
- Outbound connections from the router to unknown command-and-control infrastructure.
Detection Strategies
- Inspect HTTP access logs on affected routers for requests to CGI paths that lack valid session cookies or authentication headers.
- Deploy network IDS signatures that flag requests to the NR289-GE management interface from untrusted subnets.
- Correlate web management activity with authenticated login events to surface sessionless administrative actions.
Monitoring Recommendations
- Alert on any public internet exposure of TCP ports used by the router's HTTP admin interface.
- Monitor DHCP, DNS, and routing configuration drift on NR289-GE devices via periodic snapshots.
- Track SNMP or syslog telemetry from affected devices for unexpected reboots, firmware changes, or configuration reloads.
How to Mitigate CVE-2026-101073
Immediate Actions Required
- Remove the NR289-GE web management interface from any internet-facing network and restrict it to a trusted management VLAN.
- Replace affected Netcore NR289-GE devices where possible, given the lack of vendor response and absence of a patch.
- Rotate credentials for any accounts, services, or networks reachable through the router after confirming device integrity.
- Audit router configuration for unauthorized changes to DNS, firewall rules, port forwarding, and administrative accounts.
Patch Information
No vendor patch is available. The disclosure notes that Netcore was contacted early about this issue but did not respond. Organizations should treat affected devices as end-of-support for security purposes and plan replacement. Refer to the VulDB Vulnerability Overview #410944 for ongoing tracking.
Workarounds
- Place NR289-GE routers behind an upstream firewall that blocks inbound access to the HTTP management interface.
- Disable remote administration features on the device and allow management only from a dedicated internal host.
- Segment the router from sensitive assets so that a compromise cannot be leveraged for lateral movement.
- Monitor for anomalous traffic patterns and plan migration to a supported router platform.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
