CVE-2026-108908: falha de média gravidade em Netcore NR268
Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 4.8epss 0.2%
A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7_call_board_user_set.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
Netcore · NR268PoCs públicas encontradas — 1
cve_referencegithub.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-call-board-stored-xss.mdnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Netcore NR268
No mesmo produto, das mais perigosas para as menos.
CVE-2026-108907CRITICALNetcore NR268 CGI Execution user_ok improper authenticationEPSS 1.2%CVE-2026-108929CRITICALNetcore NR268 DDNS DDNSset.cgi execvp argument injectionEPSS 0.4%CVE-2026-108906HIGHNetcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-boundsEPSS 0.4%CVE-2026-108930MEDIUMNetcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosureEPSS 0.3%CVE-2026-76852HIGHNetcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_writeEPSS 0.3%CVE-2026-108932MEDIUMNetcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scriptingEPSS 0.3%