CVE-2026-108906: high-severity vulnerability in Netcore NR268
Netcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-bounds
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.6epss 0.4%
A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
Netcore · NR268public PoCs found — 1
cve_referencegithub.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-arp-import-overread.mdunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Netcore NR268
In the same product, most dangerous first.
CVE-2026-108907CRITICALNetcore NR268 CGI Execution user_ok improper authenticationEPSS 1.2%CVE-2026-108929CRITICALNetcore NR268 DDNS DDNSset.cgi execvp argument injectionEPSS 0.4%CVE-2026-108930MEDIUMNetcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosureEPSS 0.3%CVE-2026-76852HIGHNetcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_writeEPSS 0.3%CVE-2026-108932MEDIUMNetcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scriptingEPSS 0.3%CVE-2026-108931MEDIUMNetcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scriptingEPSS 0.3%