CVE-2026-108906: Out-of-Bounds Read in Netcore NR268

This vulnerability in Netcore NR268 1.7.121109 affects the filter_arp_put_file_cgi function in the /router/filter_arp_put_file.cgi file. By manipulating the put_file argument, an attacker can cause an out-of-bounds read, potentially leading to information disclosure or other impacts. The vulnerability is remotely exploitable without user interaction. Public exploit details have been disclosed, but the vendor has not issued any response or patch.

The vulnerability allows remote attackers to perform an out-of-bounds read, which may lead to information disclosure or other unintended behavior depending on the memory contents accessed. Given the CVSS 8.6 score and vector, the attack requires high privileges but no user interaction, and the vulnerability has high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor for official updates from Netcore. Until a fix is available, consider restricting remote access to the affected function or device to trusted networks to reduce exposure.