Argument Injection Vulnerability in Netcore NR268 Router's DDNS Functionality
CVE-2026-108929

9.4CRITICAL

Key Information:

Vendor

Netcore

Status
Nr268
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108929?

A flaw exists in the Netcore NR268 1.7.121109 router within the DDNS functionality located in /router/DDNSset.cgi. An attacker can exploit this vulnerability by manipulating the Hostname argument in the execvp function, potentially leading to unauthorized command execution. This issue can be exploited remotely, posing a significant threat to users who have not applied the necessary updates. It's crucial for device administrators to review their security posture and apply any recommended patches to mitigate this vulnerability.

Affected Version(s)

NR268 1.7.121109

References

https://vuldb.com/vuln/416753
vdb-entrytechnical-description
https://vuldb.com/vuln/416753/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108929
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nebula (VulDB User)
.