CVE-2026-108908: Cross Site Scripting in Netcore NR268

This vulnerability in Netcore NR268 1.7.121109 involves the eval function in the Web UI component's /router/l7_call_board_user_set.cgi file. Manipulation of input parameters such as title, note, URL, or content can lead to cross-site scripting (XSS), enabling remote attackers to execute arbitrary scripts in the context of the affected web interface. The vulnerability has a CVSS 4.8 (medium) score, indicating moderate impact. The vendor was contacted but did not respond, and no patch or mitigation guidance is currently available. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected web interface, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires no user interaction but does require some privileges (PR:H) and user interaction (UI:P) according to the CVSS vector. There is no indication of confidentiality, integrity, or availability impact beyond the XSS itself.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing web application firewalls or input validation workarounds to mitigate exploitation risks until a patch is released.