Out-of-Bounds Read in Netcore NR268 Router Software
CVE-2026-108906

8.6HIGH

Key Information:

Vendor: Netcore
Status: Nr268
Vendor: CVE Published:; 12 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-108906?

An out-of-bounds read vulnerability has been identified in the Netcore NR268 Router due to improper handling of arguments in the filter_arp_put_file_cgi function. This flaw can be exploited remotely, allowing an attacker to read memory regions without authorization through crafted requests. The affected version is 1.7.121109, and despite early notifications, the vendor has not responded to the disclosure. Given the potential for exploitation, users are advised to take immediate measures to ensure their systems are secure.

Affected Version(s)

NR268 1.7.121109

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-108906 - Proof of Concept