On September 28, 2026, NVD published four critical CVEs on three routers aimed at home users and small offices: Netcore NR289-GE, FAST FAC1200R and D-Link DI-8400. All four share one thing: the exploit is public. Three of them share another: the vendor was contacted and never replied.
This isn't an article about "which fix to install". At the time of writing, none has been published. It's an article about what to do with a device you can't patch.
| CVE | Device | Firmware cited | Type | CVSS 3.1 | Vector |
|---|---|---|---|---|---|
| CVE-2026-101072 | Netcore NR289-GE | 1.4.5102 | OS command injection | 10.0 | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| CVE-2026-101077 | Netcore NR289-GE | 1.4.5102 | Missing authentication | 10.0 | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| CVE-2026-101038 | FAST FAC1200R | 5.0_20201119_1.0.2 | Stack-based buffer overflow | 9.9 | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| CVE-2026-101081 | D-Link DI-8400 | 16.07 | Stack-based buffer overflow | 9.1 | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
All published by NVD on 2026-09-28. None is in CISA KEV at the time of writing. NVD provides no affected-version list (no CPE configuration): only the firmware version the researcher tested is cited. Earlier versions are probably affected too, but NVD doesn't say so.
Netcore NR289-GE — CVE-2026-101072 and CVE-2026-101077
Two flaws rated 10.0 on the same firmware:
- CVE-2026-101072: an OS command injection in a CGI handler of the web interface. A parameter passed in the request ends up in a command the router executes.
- CVE-2026-101077: missing authentication in another web interface component.
The vendor was contacted early about this disclosure but did not respond in any way.
Both vectors are PR:N: no account required. On a router, command injection usually runs with maximum privileges, and the S:C reflects that beyond the box itself, the whole network behind it is at stake.
Fix: none. The vendor didn't respond.
FAST FAC1200R — CVE-2026-101038
A stack-based buffer overflow in a parser of the interface. The vector requires PR:L, low-level authenticated access — which, on a consumer router whose admin password has often never been changed, protects very little. The cited firmware's version string points to a November 2020 build.
The vendor was contacted early about this disclosure but did not respond in any way.
Fix: none. The vendor didn't respond.
D-Link DI-8400 — CVE-2026-101081
A stack-based buffer overflow in the web administration service, on firmware 16.07. It's the least severe of the four in CVSS terms: PR:H, admin access required. But the web admin service is exactly what's too often exposed on the WAN interface.
The NVD description says nothing about D-Link's response. Check the D-Link security advisory portal to find out whether fixed firmware exists or the device is end-of-support.
Why No Fix Changes the Response
With a public exploit and no patch, the question is no longer "when to patch" but "how long to keep this device as it is". Routers in this category regularly end up in botnets: there are many of them, they're rarely updated, never monitored, and always on.
A vendor that doesn't answer a security report is unlikely to ship a fix. Plan as if none is coming.
Detection
- Admin interface reachable from the internet: check from outside whether the router's web port answers on its public address
- Modified configuration: DNS, port forwarding rules, accounts nobody changed
- Abnormal outbound traffic from the router itself: connections to unknown addresses, unusual volume
- Unexplained reboots, often the trace of an exploited or attempted memory overflow
Mitigation
- Disable remote (WAN-side) administration on each of these devices, right away.
- Restrict the web interface to the local network, ideally to a single admin workstation.
- Change the admin password if it was never changed: that's what neutralises the
PR:LandPR:Hof the two overflows. - Netcore NR289-GE and FAST FAC1200R: plan replacement. With no vendor response, there's no fix to wait for.
- D-Link DI-8400: check the D-Link site for fixed firmware or end-of-support status, and replace the device if it's no longer maintained.
- Until replacement, put the device behind another firewall where possible, and leave no management service reachable from outside.
Why Continuous Monitoring of Network Hardware Matters
These boxes often live outside any inventory: installed by a contractor, in a branch office, at a remote worker's home. Yet they're the first to fall when a public exploit comes out.
With cveo.tech, register your small routers and gateways too, and get alerted as soon as a critical CVE affects them — even when there's no fix.