CVE-2026-108907: Improper Authentication in Netcore NR268

The vulnerability CVE-2026-108907 affects Netcore NR268 version 1.7.121109 specifically in the user_ok function of the CGI Execution component. It causes improper authentication, enabling remote attackers to bypass authentication controls without privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, scope, and security requirements. The exploit has been publicly disclosed, but no vendor response or patch has been provided to date.

Successful exploitation of this vulnerability allows remote attackers to bypass authentication, potentially gaining unauthorized access to the affected system. This can lead to full compromise of confidentiality, integrity, and availability of the device or service running Netcore NR268 1.7.121109.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider mitigating exposure by restricting network access to the affected device and monitoring for suspicious activity until an official fix is released.