CVE-2026-108909: Cross-Site Request Forgery in Netcore NR268

This vulnerability in Netcore NR268 1.7.121109 involves a cross-site request forgery (CSRF) issue in an unknown functionality of the CGI Endpoint component. An attacker can remotely induce a victim to perform unintended actions without proper authorization. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity. The vendor was notified but has not provided any response or patch. Public exploit code is available.

Successful exploitation could allow remote attackers to perform unauthorized state-changing operations on the affected device via CSRF, potentially impacting the integrity of the system. Confidentiality and availability impacts are not indicated. No reports of active exploitation in the wild have been confirmed.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates. In the meantime, mitigating CSRF risks by restricting access to the device's management interface, disabling unnecessary CGI endpoints if possible, and using network-level protections such as firewall rules may reduce exposure.