CVE-2026-108929: falha crítica em Netcore NR268
Netcore NR268 DDNS DDNSset.cgi execvp argument injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.4epss 0.4%
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X
Produtos afetados
Netcore · NR268CVEs relacionadas — Netcore NR268
No mesmo produto, das mais perigosas para as menos.
CVE-2026-108907CRITICALNetcore NR268 CGI Execution user_ok improper authenticationEPSS 1.2%CVE-2026-108906HIGHNetcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-boundsEPSS 0.4%CVE-2026-108930MEDIUMNetcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosureEPSS 0.3%CVE-2026-76852HIGHNetcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_writeEPSS 0.3%CVE-2026-108932MEDIUMNetcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scriptingEPSS 0.3%CVE-2026-108931MEDIUMNetcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scriptingEPSS 0.3%