CVE-2026-101074: Netcore NR289-GE Buffer Overflow Vulnerability

CVE-2026-101074 Overview

CVE-2026-101074 is a stack-based buffer overflow in the Netcore NR289-GE router running firmware version 1.4.5102. The flaw resides in the password-check function within the /bin/boa web server binary, which handles authentication requests. An unauthenticated attacker can trigger the overflow by manipulating the Username argument sent to the authentication component. The attack is executable remotely over the network and a public exploit is available. The vendor was contacted prior to disclosure but did not respond.

Critical Impact
Remote, unauthenticated attackers can corrupt stack memory in the router's authentication handler, enabling potential code execution and full device compromise.

Affected Products

Netcore NR289-GE Router
Firmware version 1.4.5102 (build 2018.06.1418_44)
Component: /bin/boa web server (Authentication module)

Discovery Timeline

2026-09-28 - CVE-2026-101074 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-101074

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-119] in the password-check routine of the boa HTTP server that ships with the Netcore NR289-GE router. The boa daemon processes authentication requests coming from the router's web management interface. When the server parses the Username parameter supplied in the login request, it copies the attacker-controlled value into a fixed-size stack buffer without validating the input length. Because the overflow occurs in a pre-authentication code path, exploitation does not require credentials and can be launched directly over the network, including against devices with the management interface exposed to untrusted networks.

Root Cause

The root cause is missing bounds checking on the Username input before it is written to a stack-allocated buffer inside password-check. The function uses an unsafe copy operation that writes attacker-supplied bytes beyond the destination buffer, overwriting adjacent stack data including the saved return address. Embedded devices like the NR289-GE typically ship without stack canaries, ASLR, or non-executable stack protections on MIPS/ARM userland binaries, which makes return-address hijacking directly exploitable.

Attack Vector

An attacker sends a crafted HTTP authentication request to the router's web interface with an oversized Username field. Processing the request inside /bin/boa triggers the stack overflow, allowing the attacker to overwrite the saved return address and redirect execution. A proof-of-concept is published in a public GitHub repository, lowering the barrier to exploitation. See the GitHub PoC Repository and VulDB CVE-2026-101074 for technical details.

Detection Methods for CVE-2026-101074

Indicators of Compromise

HTTP POST or GET requests to the router's login endpoint containing abnormally long Username values (hundreds of bytes or more).
Unexpected crashes or reboots of the boa web server process on NR289-GE devices.
Outbound connections from the router to unknown hosts following suspicious authentication traffic, indicating potential post-exploitation activity.

Detection Strategies

Inspect inbound HTTP traffic to router management interfaces for authentication requests with oversized or non-printable Username parameters.
Deploy network IDS signatures that alert on long parameter values targeting /bin/boa login endpoints on Netcore devices.
Baseline router process stability and alert on repeated boa crashes, which may indicate exploitation attempts or fuzzing.

Monitoring Recommendations

Log and review all external access to router management ports (HTTP/HTTPS) and restrict them to trusted administrative networks.
Monitor DNS and NetFlow telemetry from the router subnet for anomalous outbound connections from the device itself.
Correlate router-sourced traffic with threat intelligence feeds that track exploited SOHO router botnets.

How to Mitigate CVE-2026-101074

Immediate Actions Required

Remove the Netcore NR289-GE web management interface from any WAN-facing or untrusted network segment.
Restrict LAN access to the router administration page to a dedicated management VLAN or specific host IPs.
Rotate administrative credentials and audit router configuration for unauthorized changes.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted but did not respond. Organizations running the NR289-GE on firmware 1.4.5102 should treat the device as unsupported for security purposes and plan replacement with a currently maintained platform.

Workarounds

Disable remote management entirely and block TCP/80 and TCP/443 inbound to the router at the upstream firewall.
Place the router behind a hardened firewall that filters all unsolicited inbound HTTP traffic to the device.
Replace affected NR289-GE units with a vendor-supported router that receives security updates.

bash

# Example upstream firewall rule to block inbound HTTP/HTTPS to the router
iptables -A FORWARD -d <router_ip> -p tcp -m multiport --dports 80,443 -j DROP