The flaw lies in the process_request function of the boa_temp handler in Netcore NR289-GE firmware 1.4.5102, where authentication is not performed before processing requests. This missing authentication allows an attacker to send crafted requests to the handler from any remote host, potentially executing privileged operations or writing arbitrary files to the device. The vulnerability is therefore a high‑impact authentication bypass that can lead to full control over the router or other destructive actions. The description states the exploit has been published and may be used.

The affected product is Netcore NR289‑GE routers running firmware version 1.4.5102. No other versions or vendor products were listed in the CNA data.

The CVSS score of 10 indicates a critical severity. The EPSS score is not available, but the published exploit and remote attack vector raise the likelihood of real‑world compromise. The vulnerability is not listed in CISA KEV, yet the combination of a zero‑day proof‑of‑concept and remote lack of authentication makes it a prime candidate for exploitation by threat actors.