CVE-2026-108906
Received Received - Intake

Out-of-Bounds Read in Netcore NR268 Router

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108906
EUVD
EUVD-2026-97518

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Netcore NR268 1.7.121109

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108906 is an out-of-bounds read flaw in Netcore NR268 Router version 1.7.121109. The vulnerability occurs in the ARP filter upload handler function filter_arp_put_file_cgi. When processing file uploads, the function uses a 1072-byte stack buffer but only initializes the first 1024 bytes. Uploading a 1024-byte chunk without a NUL terminator causes string functions to read beyond the buffer into adjacent stack memory, leaking sensitive data into logs and files.

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /router/filter_arp_put_file.cgi with a file named put_file containing a 1024-byte chunk without a NUL terminator. Check system logs for leaked stack memory in /tmp/filter_arp_file or stderr output from fprintf or fputs functions.

Impact Analysis

An authenticated attacker can exploit this remotely by sending a crafted multipart POST request to /router/filter_arp_put_file.cgi with a 1024-byte file chunk lacking a NUL terminator. This causes stack memory leakage, potentially exposing sensitive information in logs or the /tmp/filter_arp_file file. The attack may destabilize the CGI worker process, leading to reduced availability.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, violating confidentiality requirements in GDPR and HIPAA. The leaked stack memory may contain personal or protected health information, resulting in compliance breaches and potential regulatory penalties.

Mitigation Strategies

Immediately update the Netcore NR268 router to the latest firmware version if available. If no update exists, restrict access to /router/filter_arp_put_file.cgi via network firewall rules or disable the ARP filter upload feature. Monitor logs for suspicious activity and consider isolating the device from critical network segments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108906. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart