CVE-2026-108908
Received Received - Intake

Cross-Site Scripting in Netcore NR268 Router Web UI

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7_call_board_user_set.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108908
EUVD
EUVD-2026-97558

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Netcore NR268 1.7.121109

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108908 is a Stored Cross-Site Scripting (XSS) vulnerability in Netcore NR268 Router version 1.7.121109. It affects the Web UI function eval in /router/l7_call_board_user_set.cgi. User inputs like title, note, URL, and content are stored without proper filtering. When these inputs are processed using eval('('+data+')'), malicious JavaScript can be injected and later executed in the administrator's browser when viewing certain pages.

Detection Guidance

Check for unauthorized modifications in the router's web interface, particularly in the L7 Call-Board List Views feature. Inspect network traffic for requests to /router/l7_call_board_user_set.cgi with suspicious payloads in title, note, URL, or content fields. Use browser developer tools to monitor for injected scripts in admin pages.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into the router's Web UI. When an administrator accesses the affected pages, the injected scripts execute in the router's context. This can lead to session hijacking, unauthorized actions, or theft of sensitive data. The attack requires authentication but can be executed remotely.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized modifications, or loss of data integrity, potentially leading to legal and financial penalties.

Mitigation Strategies

Disable the L7 Call-Board List Views feature if possible. Apply input validation and output encoding to sanitize user-controlled fields. Update to a patched firmware version if available. Restrict access to the router's admin interface via HTTP Basic Auth and network segmentation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108908. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart