Zetlyn
GitHubGet started

A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function...

zetlyn/cve-ghsa vulnerability ghsa GHSA-89wp-g8p9-x5r7 cve CVE-2026-101074 known 2026-09-28

https://github.com/advisories/GHSA-89wp-g8p9-x5r7

Properties

cvss9.8
receipt
Source
GitHub advisories
Its words
9.8
Read by
field:cvss.score
Said since
2026-09-29 09:48 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-101074",
  "cvss": {
    "score": 9.8,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.8,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 8.9,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-119",
      "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
    }
  ],
  "description": "A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Executing a manipulation of the argument Username can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
  "ghsa_id": "GHSA-89wp-g8p9-x5r7",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-89wp-g8p9-x5r7",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-89wp-g8p9-x5r7"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-101074"
    }
  ],
  "nvd_published_at": "2026-09-28T15:17:12Z",
  "published_at": "2026-09-28T15:31:54Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-101074",
    "https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_boa_stack_overflow.md",
    "https://vuldb.com/cve/CVE-2026-101074",
    "https://vuldb.com/submit/929202",
    "https://vuldb.com/vuln/410945",
    "https://vuldb.com/vuln/410945/cti",
    "https://github.com/advisories/GHSA-89wp-g8p9-x5r7"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function...",
  "type": "unreviewed",
  "updated_at": "2026-09-28T15:32:02Z",
  "url": "https://api.github.com/advisories/GHSA-89wp-g8p9-x5r7",
  "vulnerabilities": [],
  "withdrawn_at": null
}
cweCWE-119
receipt
Source
GitHub advisories
Its words
CWE-119
Read by
field:cwes[].cwe_id
Said since
2026-09-29 09:48 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-101074",
  "cvss": {
    "score": 9.8,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.8,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 8.9,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-119",
      "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
    }
  ],
  "description": "A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Executing a manipulation of the argument Username can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
  "ghsa_id": "GHSA-89wp-g8p9-x5r7",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-89wp-g8p9-x5r7",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-89wp-g8p9-x5r7"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-101074"
    }
  ],
  "nvd_published_at": "2026-09-28T15:17:12Z",
  "published_at": "2026-09-28T15:31:54Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-101074",
    "https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_boa_stack_overflow.md",
    "https://vuldb.com/cve/CVE-2026-101074",
    "https://vuldb.com/submit/929202",
    "https://vuldb.com/vuln/410945",
    "https://vuldb.com/vuln/410945/cti",
    "https://github.com/advisories/GHSA-89wp-g8p9-x5r7"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function...",
  "type": "unreviewed",
  "updated_at": "2026-09-28T15:32:02Z",
  "url": "https://api.github.com/advisories/GHSA-89wp-g8p9-x5r7",
  "vulnerabilities": [],
  "withdrawn_at": null
}
severityhigh
From 7.0 to 8.9.
receipt
Source
GitHub advisories
Its words
high
Read by
field:severity
Said since
2026-09-29 09:48 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-101074",
  "cvss": {
    "score": 9.8,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 9.8,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 8.9,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-119",
      "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
    }
  ],
  "description": "A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Executing a manipulation of the argument Username can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
  "ghsa_id": "GHSA-89wp-g8p9-x5r7",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-89wp-g8p9-x5r7",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-89wp-g8p9-x5r7"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-101074"
    }
  ],
  "nvd_published_at": "2026-09-28T15:17:12Z",
  "published_at": "2026-09-28T15:31:54Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-101074",
    "https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_boa_stack_overflow.md",
    "https://vuldb.com/cve/CVE-2026-101074",
    "https://vuldb.com/submit/929202",
    "https://vuldb.com/vuln/410945",
    "https://vuldb.com/vuln/410945/cti",
    "https://github.com/advisories/GHSA-89wp-g8p9-x5r7"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function...",
  "type": "unreviewed",
  "updated_at": "2026-09-28T15:32:02Z",
  "url": "https://api.github.com/advisories/GHSA-89wp-g8p9-x5r7",
  "vulnerabilities": [],
  "withdrawn_at": null
}

Text

A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function... A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Executing a manipulation of the argument Username can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.