CVE-2026-108906: falha de alta gravidade em Netcore NR268
Netcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-bounds
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
41Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 8.6epss 0.4%
A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
Netcore · NR268PoCs públicas encontradas — 1
cve_referencegithub.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-arp-import-overread.mdnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Netcore NR268
No mesmo produto, das mais perigosas para as menos.
CVE-2026-108907CRITICALNetcore NR268 CGI Execution user_ok improper authenticationEPSS 1.2%CVE-2026-108929CRITICALNetcore NR268 DDNS DDNSset.cgi execvp argument injectionEPSS 0.4%CVE-2026-108930MEDIUMNetcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosureEPSS 0.3%CVE-2026-76852HIGHNetcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_writeEPSS 0.3%CVE-2026-108932MEDIUMNetcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scriptingEPSS 0.3%CVE-2026-108931MEDIUMNetcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scriptingEPSS 0.3%