CVE-2026-108931: Cross Site Scripting in Netcore NR268

This vulnerability affects Netcore NR268 version 1.7.121109 in the DHCP Handler component. The issue is a cross-site scripting vulnerability caused by improper handling of the Hostname argument in the eval function within dhcp_dynamicip_show.cgi. Remote attackers can exploit this flaw to execute arbitrary scripts in the context of the affected application. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor was notified but has not issued any response or fix. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary scripts via the Hostname parameter, potentially leading to session hijacking, information disclosure, or other client-side impacts. The vulnerability requires no privileges and no user interaction beyond visiting a crafted URL. The medium CVSS score reflects moderate risk, with limited impact on confidentiality and integrity but potential impact on availability and user trust.

No official patch or remediation has been provided by the vendor. Since the vendor has not responded and no fix is available, users should consider implementing web application firewall (WAF) rules to block malicious inputs targeting the Hostname parameter or restrict access to the vulnerable interface. Monitor for exploit attempts and apply network-level controls to limit exposure until a vendor fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.