Is CVE-2026-101076 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101076 being exploited in the wild.

How severe is CVE-2026-101076?

Critical severity, with a CVSS score of 10, published 28 September 2026.

Which products and versions are affected?

Netcore NR289-GE 1.4.5102 (firmware 2018.06.14).

Is there a fix for CVE-2026-101076?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-101076 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-101076?

Check whether you run Netcore NR289-GE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101076: Netcore NR289-GE OS command injection in NTP handler

CVE-2026-101076 · Severity: critical · CVSS 10 · Published 2026-09-28

The Netcore NR289-GE is an SMB router and WiFi access point controller. A flaw in the NTP server configuration endpoint allows unauthenticated attackers to inject arbitrary OS commands that execute as root, enabling complete device compromise and lateral movement to managed access points. Exploitation requires at least one access point to be registered with the controller but no user authentication.

Technologies: Netcore NR289-GE. Vendors: Netcore.

Quick answers

Is CVE-2026-101076 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101076 being exploited in the wild.
How severe is CVE-2026-101076?: Critical severity, with a CVSS score of 10, published 28 September 2026.
Which products and versions are affected?: Netcore NR289-GE 1.4.5102 (firmware 2018.06.14).
Is there a fix for CVE-2026-101076?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-101076 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-101076?: Check whether you run Netcore NR289-GE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

OS command injection (CWE-78) in /set_ntp_server_ip.cgi due to unsanitized ntp_ip parameter passed directly to system() via sprintf. The CGI handler is reachable without authentication via a .ico whitelist bypass. Payload injection occurs within double-quoted context, allowing semicolon-delimited command chaining. The strncpy() truncation limits payload to ~12 command characters on this endpoint, but side-effect verification and multi-request staging are viable.

Affected products

Netcore NR289-GE 1.4.5102 (firmware 2018.06.14)

Timeline

2026-09-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.