A vulnerability was identified in Netcore NR268 1.7.121109. (CVE-2026-108908)

Netcore NR268 version 1.7.121109 contains a cross-site scripting vulnerability in the eval function of the /router/l7_call_board_user_set.cgi file in the Web UI component. This vulnerability arises from improper handling of user-supplied input in parameters like title, note, URL, and content, enabling remote attackers to inject and execute arbitrary scripts. The vulnerability is publicly known, and exploit code is available. The vendor was contacted but did not provide any response or remediation guidance.

The vulnerability allows remote attackers to perform cross-site scripting attacks by injecting malicious scripts through specific parameters in the Web UI. The impact is limited to integrity as per the CVSS vector (no confidentiality or availability impact). The low CVSS score (2.4) reflects this limited impact. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should exercise caution when exposing the affected interface and consider limiting access or applying web application firewall rules to detect and block XSS payloads targeting the affected parameters.