This vulnerability exists in Netcore NR289-GE 1.4.5102 within the CGI handler component, specifically the /set_ntp_server_ip.cgi file. The system function processes the ntp_ip argument insecurely, enabling remote attackers to perform OS command injection. The vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor was notified but did not respond or provide a fix. Public exploit code is available.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device without authentication. This can lead to full compromise of the device, including data theft, service disruption, or further network penetration. Given the critical CVSS score and public exploit availability, the risk is severe.

No official patch or remediation has been provided by the vendor. Users should consider isolating affected devices from untrusted networks and monitoring for suspicious activity. Until a vendor fix is available, avoid exposing the vulnerable CGI endpoint to external networks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.