Security Check Bypass in Netcore NR268 Firmware by Netcore
CVE-2026-76853

7.2HIGH

Key Information:

Vendor

Netcore

Status
Nr268
Vendor
CVE Published:
15 September 2026

What is CVE-2026-76853?

The Netcore NR268 firmware version 1.7.121109 has a vulnerability that allows attackers to bypass security checks during the restoration of archive files. This issue resides in the parame_put_file.cgi script, where inadequate prefix validation allows malicious users to manipulate the handling of restricted files, posing a significant risk to affected devices. Proper safeguards are lacking, which makes it crucial for users to review their firmware and take proactive measures to secure their systems.

Affected Version(s)

NR268 1.7.121109

References

https://github.com/draw-ctf/netcore-router-public-refs/bl...
third-party-advisory
https://www.vulncheck.com/advisories/netcore-nr268-1.7.12...
third-party-advisory

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhou Ao
Yin Luxing
Jiang Yuxuan
Liu Xin
@Nebusec
.