CVE-2026-108907
Received Received - Intake

Authentication Bypass in Netcore NR268 Router

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108907
EUVD
EUVD-2026-97677

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Netcore NR268 1.7.121109

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108907 is an improper authentication vulnerability in Netcore NR268 Router firmware version NR268-V1.7.121109.bin. The flaw lies in the Boa web server's user_ok() function, which fails to validate credentials properly when the authentication cache file (/tmp/passwd) is missing or corrupted. Instead of rejecting requests, the system incorrectly grants access, allowing unauthorized users to bypass authentication checks.

Detection Guidance

Check for the presence of the vulnerable firmware version NR268-V1.7.121109.bin on Netcore NR268 routers. Verify if the /tmp/passwd file exists and is valid. Test authentication bypass by sending HTTP requests with arbitrary credentials to CGI endpoints like /router/WebPortSet_show.cgi or /router/WebRemotePortShow.cgi and observe if unauthorized access is granted.

Commands to detect: 1) SSH into the router and run 'cat /etc/firmware_version' to check version. 2) Run 'ls -l /tmp/passwd' to check for the credential cache file. 3) Use curl to test endpoints: 'curl -v -u test:test http://<router-ip>/router/WebPortSet_show.cgi' and check for 200 OK responses without proper authentication.

Impact Analysis

This vulnerability allows remote attackers to gain unauthorized access to privileged CGI endpoints on the router. They can perform sensitive actions like changing configurations, rebooting the system, or uploading malicious firmware without proper authentication. This compromises the device's confidentiality, integrity, and availability.

Mitigation Strategies

Immediately update the router firmware to a patched version if available. If no patch exists, disable remote access to CGI endpoints or block external access to the router's web interface. Manually restore the /tmp/passwd file with valid credentials to restore proper authentication. Monitor network traffic for unauthorized access attempts to privileged endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart