A flaw in the Netcore NR289‑GE router firmware allows a remote attacker to inject arbitrary operating system commands through the /ap_ip.cgi CGI script. The vulnerability arises because the ip parameter is not properly validated, enabling attackers to craft input that is executed by the web server process. Successful exploitation gives the attacker full control over the router, enabling data exfiltration, denial of service, or use of the device as a pivot for further attacks.

The issue affects Netcore NR289‑GE routers running firmware version 1.4.5102. No other OEMs or firmware releases have been identified as impacted in the advisory.

The CVSS base score of 10 indicates maximum severity, and the EPSS score of 2% shows a modest but non‑negligible likelihood of exploitation. Although the vulnerability is not listed in the CISA KEV catalog, the publicly documented exploit and the inferred remote attack vector via HTTP suggest that attackers can gain command execution without authentication. Overall, the threat level remains critical.