External risk intelligence

Netcore NR289-GE NTP Server IP Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-101076

The vulnerability affects a CGI handler component in a router device. Routers are commonly deployed as internet-facing edge gateways, and management interfaces or CGI-based configuration endpoints are frequently exposed or reachable in these deployment patterns.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Netcore routers, specifically within the CGI handler component responsible for managing NTP server IP settings. This issue allows for remote command injection, meaning an attacker could potentially execute arbitrary commands on the affected device without any authentication. The exploit is publicly available, increasing the risk of its use. The vendor has not responded to inquiries regarding this disclosure.

Allows remote attackers to inject commands.
Matters due to public exploit and router exposure.
Confirm relevance and potential exposure for leadership.

Attack Path

How an attacker could exploit the issue

An attacker can remotely inject operating system commands by manipulating a parameter in the CGI handler's NTP server IP configuration. This allows them to execute arbitrary commands on the affected device, potentially leading to a complete compromise.

No special access required.
Manipulate NTP server IP argument.
Full system compromise possible.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a remote attacker could inject operating system commands by manipulating arguments in the `set_ntp_server_ip.cgi` file. This could potentially affect the device's system behavior and configuration.

System configuration and behavior could be affected.
Remote attackers could inject commands via the CGI handler.
Undefined impacts on system integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The affected Netcore NR289-GE router's CGI Handler is likely managed by the infrastructure or network operations team, potentially with oversight from a vendor management team due to the device's nature. The immediate first step is to identify all instances of this router, determine their network exposure and criticality, and then assign ownership for remediation planning.

Infrastructure or network team owns the issue.
Verify network exposure and criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Netcore NR289-GE device?

The Netcore NR289-GE is a networking router typically used to manage internet traffic and connectivity for a network. It acts as a gateway, often responsible for routing data between local devices and the broader internet. In this model, specific firmware version 1.4.5102 includes a CGI handler component designed to manage administrative tasks, such as configuring network time protocol (NTP) server settings for synchronization.

What does command injection mean in CVE-2026-101076?

This vulnerability is classified as OS Command Injection, specifically CWE-77 and CWE-78. It means an attacker can input malicious system commands into a specific field that the router processes improperly. Instead of just setting an NTP server address, the device executes the attacker's hidden instructions, granting them unauthorized control over the router's operating system.

How is the command injection triggered?

An attacker triggers the vulnerability by sending a specially crafted request to the /set_ntp_server_ip.cgi file on the router. They manipulate the 'ntp_ip' argument to include unauthorized commands. The bug is triggered solely through this web-based interface; it does not require physical access to the device or any prior authentication from a legitimate user.

Why is this router vulnerability relevant to me?

According to Halo Surface Signal, this is highly relevant because routers are often positioned as internet-facing gateways. Because the CGI handler endpoint is typically reachable from the network, the device is exposed to remote threats. If your router serves as the edge of your network, attackers may be able to reach this configuration interface directly from the internet.

What are the first steps to address this issue?

Start by locating all Netcore NR289-GE devices within your network environment. Once identified, assess whether these devices are exposed to the internet or reachable by untrusted users. Since the vendor has not provided a response, coordinate with your infrastructure or network operations teams to restrict access to the management interface and develop a plan to isolate or replace the affected hardware.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.