Is CVE-2026-101074 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101074 being exploited in the wild.

How severe is CVE-2026-101074?

Critical severity, with a CVSS score of 9.8, published 28 September 2026.

Is there a fix for CVE-2026-101074?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-101074 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-101074?

Check whether you run Netcore NR289-GE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101074: Netcore NR289-GE stack buffer overflow in boa

CVE-2026-101074 · Severity: critical · CVSS 9.8 · Published 2026-09-28

Netcore NR289-GE is an SMB router with web-based management. An unauthenticated attacker can trigger a stack buffer overflow in the web server's authentication handler by sending a malformed username, crashing the management interface or potentially executing arbitrary code as root. The vulnerability requires no credentials and can be exploited with a single network request.

Technologies: Netcore NR289-GE. Vendors: Netcore.

Quick answers

Is CVE-2026-101074 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101074 being exploited in the wild.
How severe is CVE-2026-101074?: Critical severity, with a CVSS score of 9.8, published 28 September 2026.
Which products and versions are affected?: Netcore NR289-GE 1.4.5102.
Is there a fix for CVE-2026-101074?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-101074 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-101074?: Check whether you run Netcore NR289-GE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The boa web server's password-check function in /bin/boa uses strcpy to copy the decoded username from an HTTP Basic Authorization header into two 64-byte stack buffers without bounds checking. An attacker can craft a username exceeding 96 bytes to overflow and overwrite the saved return address and register values on the stack, achieving deterministic program counter control. The vulnerability is pre-authentication and exploitable remotely via a single HTTP GET request.

Affected products

Netcore NR289-GE 1.4.5102

Timeline

2026-09-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.