Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108906— Netcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-bounds

Quick assessment

Affected
Netcore NR268
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Netcore NR268 1.7.121109 版本中发现了一个漏洞。该漏洞影响了文件 中的 函数。对参数 的操纵可导致越界读取。该漏洞可被远程触发利用。相关利用代码已公开，可以被直接使用。厂商在漏洞披露初期已被联系，但并未作出任何回应。

CVSS 7.2 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
Netcore NR268 1.7.121109 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108906

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Netcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-bounds
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Netcore NR268 1.7.121109 cpe:2.3:a:netcore:nr268:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-108906

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108906

请登录查看更多情报信息。

Proof of Concept for CVE-2026-108906 (1)

Same Patch Batch · Netcore · 2026-10-12 · 8 CVEs total

CVE-2026-108907 10.0 CRITICAL Netcore NR268 CGI Execution user_ok improper authentication
CVE-2026-108929 9.9 CRITICAL Netcore NR268 DDNS DDNSset.cgi execvp argument injection
CVE-2026-108909 4.3 MEDIUM Netcore NR268 CGI Endpoint cross-site request forgery
CVE-2026-108931 4.3 MEDIUM Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting
CVE-2026-108932 4.3 MEDIUM Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting
CVE-2026-108930 2.7 LOW Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure
CVE-2026-108908 2.4 LOW Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting

IV. Related Vulnerabilities

Same product: NR268
Same vendor: Netcore
Same weakness: CWE-125

V. Comments for CVE-2026-108906

No comments yet

Leave a comment