CVE-2026-108930: Information Disclosure in Netcore NR268

This vulnerability in Netcore NR268 1.7.121109 involves the DDNS Handler's ddns_wan_list_show function, where improper handling of user_idN/passwordN arguments leads to information disclosure. The flaw can be exploited remotely without user interaction and requires high privileges. The vendor was notified but has not issued a response or patch. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required for attack initiation, and low impact on confidentiality.

Successful exploitation allows remote attackers to disclose sensitive information via crafted arguments to the ddns_wan_list_show.cgi script. The impact is limited to information disclosure with no indication of further privilege escalation or system compromise. The medium severity reflects the moderate risk posed by this vulnerability.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fix is published, users should consider limiting access to the affected function or device, applying network-level restrictions, or monitoring for suspicious activity related to the DDNS Handler. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.