Cross Site Scripting Vulnerability in Netcore NR268 Router DHCP Hostname Handler

CVE-2026-108932

What is CVE-2026-108932?

A vulnerability was identified in the Netcore NR268 Router, specifically within the DHCP Hostname Handler's function named eval in the file filter_hosts_dump.cgi. This security flaw allows attackers to manipulate the Hostname argument, enabling the execution of cross site scripting attacks. The vulnerability has been publicly disclosed, and remote exploitation is feasible, posing significant risks to users. Despite early notification, the vendor has not addressed this issue.

References