A vulnerability has been found in Netcore NR268 1.7.121109. (CVE-2026-108906)

CVE-2026-108906 is a vulnerability in Netcore NR268 version 1.7.121109 affecting the filter_arp_put_file_cgi function in /router/filter_arp_put_file.cgi. The vulnerability arises from improper handling of the put_file argument, resulting in an out-of-bounds read condition. This flaw can be triggered remotely, potentially allowing an attacker to read memory outside the intended bounds. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with network attack vector, low attack complexity, and requiring high privileges but no user interaction. The vendor was contacted but did not respond, and no patch or fix has been published. Public exploit information is available, increasing the risk of exploitation.

Successful exploitation of this vulnerability can lead to high impact including confidentiality, integrity, and availability compromises due to out-of-bounds memory reads. An attacker with high privileges can remotely trigger the flaw, potentially exposing sensitive information or causing denial of service conditions. The CVSS score of 7.2 reflects the significant risk posed by this vulnerability.

No official patch or remediation is currently available from the vendor, who has not responded to the disclosure. Users should apply general risk mitigation strategies such as restricting network access to the affected device, disabling the vulnerable functionality if possible, and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.