Threat Intelligence Database

Netcore NR268 version 1.7.121109 contains a critical vulnerability in the user_ok function of its CGI Execution component that allows improper authentication. This flaw can be exploited remotely without any privileges or user interaction. The vulnerability has a maximum CVSS score of 10.0, indicating severe impact on confidentiality, integrity, and availability. The vendor was notified but has not responded or issued a patch. Public exploit details have been disclosed, though no active exploitation in the wild is currently known.

A cross-site scripting (XSS) vulnerability exists in Netcore NR268 version 1.7.121109 within the Web UI component, specifically in the eval function of /router/l7_call_board_user_set.cgi. The vulnerability allows remote attackers to manipulate arguments such as title, note, URL, or content to execute script code. The vendor has not responded to disclosure attempts, and no patch information is available. The CVSS score is low (2.4), indicating limited impact.

CVE-2026-108907 is a critical improper authentication vulnerability in Netcore NR268 version 1.7.121109 affecting the user_ok function within the CGI Execution component. This flaw allows remote attackers to bypass authentication mechanisms. The vulnerability has a CVSS 4.0 base score of 10.0, indicating maximum severity. The exploit has been publicly disclosed, but no known exploits are reported in the wild. The vendor was contacted but did not respond, and no patch or remediation information is currently available.

CVE-2026-108906 is a high-severity vulnerability in Netcore NR268 version 1.7.121109. It involves an out-of-bounds read in the function filter_arp_put_file_cgi within /router/filter_arp_put_file.cgi. The vulnerability is triggered by manipulating the put_file argument and can be exploited remotely. The exploit code has been publicly disclosed. The vendor has not responded to the disclosure, and no patch information is available.