CVE-2026-108932

Received Received - Intake

Cross-Site Scripting in Netcore NR268 Router

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description

A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filter_hosts_dump.cgi of the component DHCP Hostname Handler. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-108932

Affected Vendors & Products

Vendor	Product	Version / Range
Netcore	NR268	1.7.121109

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in Netcore NR268 version 1.7.121109. It exists in the DHCP Hostname Handler component, specifically in the eval function of the file filter_hosts_dump.cgi. The attack involves manipulating the Hostname argument to inject malicious scripts.

Detection Guidance

Detection involves checking for vulnerable Netcore NR268 devices with version 1.7.121109. Inspect network traffic for requests to filter_hosts_dump.cgi with Hostname parameters containing XSS payloads. Use tools like Nmap to scan for the device and version.

Impact Analysis

An attacker could exploit this to execute arbitrary scripts in a victim's browser, potentially stealing session cookies, credentials, or other sensitive data. The attack is remote and requires no authentication.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Compliance may be compromised if exploited.

Mitigation Strategies

Immediately update the Netcore NR268 device to the latest firmware if available. If no update exists, restrict access to the filter_hosts_dump.cgi endpoint via firewall rules. Monitor network traffic for suspicious XSS attempts.

Hi! I’m here to help you understand CVE-2026-108932. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70