CVE-2026-108930

Received Received - Intake

Information Disclosure in Netcore NR268 via DDNS Handler

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description

A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the component DDNS Handler. The manipulation of the argument user_idN/passwordN leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-108930

Affected Vendors & Products

Vendor	Product	Version / Range
Netcore	NR268	1.7.121109

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability is in Netcore NR268 version 1.7.121109. It involves the DDNS Handler component, specifically the ddns_wan_list_show.cgi file. The issue allows remote attackers to access sensitive information by manipulating user_idN and passwordN parameters in the ddns_wan_list_show function.

Detection Guidance

This vulnerability involves the DDNS Handler in Netcore NR268 1.7.121109, where user_idN/passwordN parameters may leak information. Check for unusual requests to ddns_wan_list_show.cgi or inspect network traffic for exposed credentials in these parameters.

Impact Analysis

An attacker could exploit this to disclose confidential information such as credentials or network details. Since the attack is remote and requires no authentication, unpatched systems are at risk of unauthorized data exposure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations must patch systems to avoid compliance breaches and potential legal penalties.

Mitigation Strategies

Immediately update the Netcore NR268 firmware if a patch is available. If no patch exists, restrict access to the DDNS Handler interface via network segmentation or firewall rules. Monitor logs for suspicious activity targeting ddns_wan_list_show.cgi.

Hi! I’m here to help you understand CVE-2026-108930. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70