Cross-Site Request Forgery in Netcore NR268 Router
CVE-2026-108909

5.3MEDIUM

Key Information:

Vendor

Netcore

Status
Nr268
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108909?

A security flaw has been identified in the Netcore NR268 router, specifically involving the CGI Endpoint functionality. This vulnerability allows an attacker to perform cross-site request forgery actions, which can be executed remotely. The exploit has been made public, highlighting its potential risk for users of the affected device. The vendor was notified about the vulnerability; however, they have not yet responded to the disclosure. Users are advised to remain vigilant and monitor their devices for unusual activity.

Affected Version(s)

NR268 1.7.121109

References

https://vuldb.com/vuln/416704
vdb-entry
https://vuldb.com/vuln/416704/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108909
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nebula (VulDB User)
VulDB CNA Team
.