This vulnerability affects Netcore NR289-GE version 1.4.5102 and is caused by missing authentication in the process_request function within the boa_temp Handler component. This flaw allows remote attackers to bypass authentication controls, potentially leading to unauthorized access or control. The vulnerability is publicly disclosed with a critical CVSS 4.0 score of 10.0 and an exploit has been published. The vendor was contacted but did not provide any response or patch information.

The impact is critical due to the complete lack of authentication in a key component, allowing remote attackers to potentially gain unauthorized access or control over the affected device. This could lead to full compromise of the device or network segment where it is deployed. Although no active exploitation in the wild is currently known, the availability of exploit code increases the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider isolating affected devices from untrusted networks and monitor for suspicious activity. Applying network-level access controls to restrict access to the device's management interfaces is recommended until a patch is released.