The Netcore NR289-GE version 1.4.5102 contains an OS command injection vulnerability in the system function of the /ap_ip.cgi CGI Handler component. By manipulating the 'ip' parameter, an attacker can remotely execute arbitrary operating system commands on the affected device. This vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 10.0, reflecting critical severity. The vendor was contacted but did not provide any response or patch information. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected Netcore NR289-GE device, potentially leading to full compromise of the device, including unauthorized control, data theft, or disruption of service. The vulnerability requires no authentication and can be triggered remotely, making it highly impactful. There are no confirmed reports of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor, as they have not responded to disclosure attempts. Users of Netcore NR289-GE version 1.4.5102 should consider isolating affected devices from untrusted networks and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.