CVE-2026-108931

Received Received - Intake

Cross-Site Scripting in Netcore NR268 DHCP Handler

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description

A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dynamicip_show.cgi of the component DHCP Handler. The manipulation of the argument Hostname results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-108931

Affected Vendors & Products

Vendor	Product	Version / Range
Netcore	NR268	1.7.121109

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in Netcore NR268 version 1.7.121109. It exists in the DHCP Handler component, specifically in the eval function of the file dhcp_dynamicip_show.cgi. The vulnerability is triggered by manipulating the Hostname argument, allowing an attacker to inject malicious scripts.

Detection Guidance

This vulnerability involves a reflected cross-site scripting (XSS) flaw in the Netcore NR268 device via the Hostname parameter in dhcp_dynamicip_show.cgi. To detect it, inspect web server logs for suspicious requests targeting this CGI script with XSS payloads in the Hostname parameter. Check for unusual input patterns like <script> tags or JavaScript events in HTTP requests to the device's web interface.

Impact Analysis

An attacker could exploit this vulnerability to execute arbitrary scripts in a user's browser when they access the vulnerable application. This could lead to session hijacking, defacement of web pages, or theft of sensitive information like cookies or credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Immediately restrict access to the device's web interface from untrusted networks. Apply input validation and output encoding to sanitize the Hostname parameter in dhcp_dynamicip_show.cgi. Update to a patched firmware version if available. Monitor for exploitation attempts and consider disabling the DHCP handler component if not required.

Hi! I’m here to help you understand CVE-2026-108931. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70