CVE-2026-108932: fallo de gravedad media en Netcore NR268
Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.3%
A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filter_hosts_dump.cgi of the component DHCP Hostname Handler. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
Netcore · NR268PoCs públicas encontradas — 1
cve_referencegithub.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-dhcp-hostname-stored-xss.mdno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Netcore NR268
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-108907CRITICALNetcore NR268 CGI Execution user_ok improper authenticationEPSS 1.2%CVE-2026-108929CRITICALNetcore NR268 DDNS DDNSset.cgi execvp argument injectionEPSS 0.4%CVE-2026-108906HIGHNetcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-boundsEPSS 0.4%CVE-2026-108930MEDIUMNetcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosureEPSS 0.3%CVE-2026-76852HIGHNetcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_writeEPSS 0.3%CVE-2026-108931MEDIUMNetcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scriptingEPSS 0.3%