Threat database

Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into /tmp/boa_temp.update or /tmp/boa_temp.para, tampering with pending firmware updates or configuration restores or causing denial of service.

Netcore NR256CN devices up to version 1.5.140116 have an authentication bypass vulnerability. This flaw allows unauthenticated attackers to access protected management CGI handlers by prefixing the URI with certain public routes such as l7_web_auth.cgi or .ico paths. The vulnerability enables attackers to invoke management functions without valid credentials. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.

Netcore NR256CN devices up to version 1.5.140116 have a critical pre-authentication stack-based buffer overflow vulnerability in the Boa web server's user_ok() function. This flaw arises from unbounded strcpy() calls copying Basic-auth usernames into fixed 64-byte stack buffers. An unauthenticated attacker can exploit this by sending a username longer than 63 bytes to any protected /router/*.cgi route, potentially crashing the Boa process or executing arbitrary code.

Netcore NR256CN devices up to version 1.5.140116 have a NULL pointer dereference vulnerability in the Boa web server's user_auth() function. This flaw allows unauthenticated attackers to crash the server by sending a malformed Basic Authorization header lacking a colon, such as one decoding to a single character. Exploiting this vulnerability results in denial of access to the device's management interface by killing the main Boa process.

CVE-2026-108932 is a cross-site scripting (XSS) vulnerability in Netcore NR268 version 1.7.121109. The flaw exists in the eval function of the file filter_hosts_dump.cgi within the DHCP Hostname Handler component. An attacker can manipulate the Hostname argument to execute arbitrary scripts remotely. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a patch. The CVSS 4.0 score rates this as a medium severity issue.

CVE-2026-108931 is a cross-site scripting (XSS) vulnerability in Netcore NR268 version 1.7.121109. It affects the eval function in the dhcp_dynamicip_show.cgi file within the DHCP Handler component. The vulnerability arises from improper handling of the Hostname argument, allowing remote attackers to inject malicious scripts. The exploit code has been publicly disclosed. The vendor has not responded to the disclosure, and no patch or remediation information is available.

CVE-2026-108930 is an information disclosure vulnerability in Netcore NR268 version 1.7.121109. It affects the ddns_wan_list_show function in the DDNS Handler component. The vulnerability arises from manipulation of the user_idN/passwordN arguments, which can be exploited remotely. The vendor has not responded to the disclosure, and no patch or remediation is currently documented. The CVSS 4.0 base score is 5.1, indicating medium severity.

CVE-2026-108929 is a critical vulnerability in Netcore NR268 version 1.7.121109. It involves an argument injection flaw in the execvp function within the /router/DDNSset.cgi file of the DDNS component. This flaw allows remote attackers to manipulate the Hostname argument, potentially leading to unauthorized command execution.

CVE-2026-108909 is a medium severity cross-site request forgery (CSRF) vulnerability affecting Netcore NR268 version 1.7.121109. The flaw exists in an unspecified CGI Endpoint component, allowing remote attackers to perform unauthorized actions via CSRF. The exploit code has been publicly released. The vendor has not responded to the disclosure, and no patch or mitigation guidance is currently available.

CVE-2026-108908 is a cross-site scripting (XSS) vulnerability in Netcore NR268 version 1.7.121109. It affects the eval function in the /router/l7_call_board_user_set.cgi file of the Web UI component. The vulnerability allows remote attackers to manipulate certain arguments (title, note, URL, content) to execute malicious scripts. Exploit code is publicly available, but no vendor response or patch has been provided.

CVE-2026-108907 is a critical improper authentication vulnerability in Netcore NR268 version 1.7.121109 affecting the user_ok function of the CGI Execution component. This flaw allows remote attackers to bypass authentication mechanisms. The vulnerability has a CVSS 4.0 base score of 10.0, indicating maximum severity. The exploit has been publicly disclosed, but no known exploits are reported in the wild. The vendor was contacted but did not respond or provide a patch.

CVE-2026-108906 is a high-severity vulnerability in Netcore NR268 version 1.7.121109. It involves an out-of-bounds read in the filter_arp_put_file_cgi function of the /router/filter_arp_put_file.cgi file. The vulnerability is triggered by manipulating the put_file argument and can be exploited remotely. The exploit has been publicly disclosed, and the vendor has not responded to the disclosure.

A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file /lib/functions/backup_common.sh of the component Backup/Restore. This manipulation of the argument aes_pass causes use of hard-coded cryptographic key . It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missing authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-101076 is a critical OS command injection vulnerability in Netcore NR289-GE version 1.4.5102. It affects the system function in the /set_ntp_server_ip.cgi CGI Handler component, allowing remote attackers to inject OS commands via the ntp_ip argument. Exploit code is publicly available, and the vendor has not responded to disclosure attempts.

A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /location_time.cgi of the component Location Time Handler. The manipulation of the argument mac leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Executing a manipulation of the argument Username can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-101073 is a medium severity vulnerability in Netcore NR289-GE version 1.4.5102 involving improper authentication in the CGI Dispatcher component (/bin/boa). This flaw allows remote attackers to bypass authentication mechanisms. The exploit code has been publicly released, increasing the risk of attacks. The vendor has not responded to the disclosure, and no patch or remediation guidance is currently available.