CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-101076 — A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the func...

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /set_ntp_server_ip.cgi of the component CGI Handler. The manipulation of the argument ntp_ip results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /set_ntp_server_ip.cgi of the component CGI Handler. The manipulation of the argument ntp_ip results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSS Score: 10. Published: 2026-09-28T16:17:11.947.

Indicators of Compromise (1)

CVE (1)
CVE-2026-101076
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 28, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-92084 — The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for W...

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcode

CVE-2026-92084
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-87115 — The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable...

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as

CVE-2026-87115
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-82042 — UTMStack before 11.2.16 contains an authentication bypass vulnerability that all...

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtai

CVE-2026-82042
NIST NVD