A vulnerability was determined in Netcore NR268 1.7.121109. (CVE-2026-108907)

CVE-2026-108907 identifies a critical authentication bypass vulnerability in Netcore NR268 1.7.121109, specifically in the user_ok function within the CGI Execution component. This vulnerability allows remote attackers to manipulate authentication mechanisms, potentially gaining unauthorized access. The flaw is remotely exploitable with no required privileges or user interaction. The vulnerability has been publicly disclosed, and the vendor has not provided any response or remediation. The CVSS v3.1 base score is 10.0, reflecting critical severity with impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system, including unauthorized access and control, data disclosure, and service disruption. The critical CVSS score indicates that all major security properties (confidentiality, integrity, availability) are severely impacted. Since the vulnerability allows remote exploitation without authentication, it poses a high risk to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, organizations should consider implementing network-level mitigations such as restricting access to the vulnerable component or disabling the CGI Execution feature if feasible until an official fix is available.