EUVD-2026-97518
GHSA-h5cj-ppxw-rw3v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authenticated router access
-
DeliverySend crafted request to filter_arp_put_file.cgi
-
ExploitManipulate put_file argument
-
ExecutionTrigger out-of-bounds read in handler
-
ImpactLeak memory contents or crash service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach and send a request to the /router/filter_arp_put_file.cgi endpoint with a controlled put_file argument, and per the CVSS vector (PR:H) requires high/administrative privileges on the router - i.e., an already-authenticated management session, not an anonymous external attacker. No end-user interaction is needed (UI:N). The primary limiting factors are the prior-authentication requirement and the specific NR268 firmware version 1.7.121109; impact is bounded to memory disclosure and potential service crash consistent with an out-of-bounds read rather than code execution. |
| Impact | Signals are mixed and point to a moderate, not top-tier, priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N) describes a network-reachable, low-complexity flaw but explicitly requires high privileges (PR:H), meaning an attacker must already hold administrative/authenticated access to the router before reaching the vulnerable /router/filter_arp_put_file.cgi handler - a significant real-world limiter. Exploit maturity is E:P (proof-of-concept), consistent with the input POC signal: publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. A notable internal inconsistency: the vector claims full VC:H/VI:H/VA:H impact, yet the description and CWE classification describe an out-of-bounds READ, which realistically yields memory disclosure and possible process crash rather than integrity compromise - the VI:H (integrity) rating appears overstated for a pure overread and should be verified. Net: this is a credible but privilege-gated bug in a niche device, not a drop-everything issue, though the unpatched status raises its practical weight. |
| Exploit ScenarioDerived | An attacker who already holds administrative/authenticated access to a Netcore NR268 router (firmware 1.7.121109) sends a crafted request to /router/filter_arp_put_file.cgi with a manipulated put_file argument, triggering an out-of-bounds read in filter_arp_put_file_cgi. This leaks adjacent process memory or crashes the CGI handler; a public proof-of-concept exploit has been disclosed. Because CVSS AC is low, the request is simple to construct once the attacker is authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
An out-of-bounds read in the Netcore NR268 router firmware (version 1.7.121109) can be triggered by manipulating the put_file argument of the ARP filter import handler at /router/filter_arp_put_file.cgi, allowing an attacker with an authenticated management session to disclose process memory or crash the device; no code execution or lateral impact was assessed. Exploitation requires high/administrative privileges (CVSS PR:H) on the router, so this is not reachable by an anonymous external attacker despite the network-facing attack vector. Publicly available exploit code exists - the researcher's write-up is published on GitHub and the vendor was contacted but never responded - and the CVSS 4.0 vector carries an E:P (proof-of-exploit) modifier; no CISA KEV listing and no EPSS score were supplied in the available data, and no vendor-released patch has been identified, so unpatched, internet- or management-exposed NR268 units should be treated as at risk of authenticated memory disclosure and denial of service.
RemediationAI
No vendor-released patch identified at time of analysis: the vendor was contacted early about this disclosure and never responded, and no fixed firmware version, GitHub commit, or patched release is referenced anywhere in the available intelligence, so there is no exact upgrade target to cite and administrators should not assume a silently fixed build. Because publicly available exploit code exists and the underlying flaw is an out-of-bounds read reachable only with high/administrative privileges (PR:H), the effective controls are exposure reduction and privilege containment rather than patching: disable remote/WAN-side administration and restrict the management interface to a dedicated trusted VLAN or appliance-side firewall allowlist, so only administrators can reach /router/filter_arp_put_file.cgi (trade-off: loses convenient remote management and requires out-of-band access for maintenance); rotate the administrative credentials on the device and remove any default or shared accounts (trade-off: operational overhead, and this does not stop an already-authenticated admin from triggering the bug, it only reduces who can reach the precondition); and, where the ARP filter import feature is not required, avoid using the filter_arp_put_file.cgi import path and prefer manual ARP-binding configuration (trade-off: removes automation and may not be possible if ARP filtering is operationally required). Since exploitation yields at best memory disclosure and process termination, monitor the router's management service for unexpected restarts, log resets, or memory-dump-like output and treat unexplained admin-service crashes as a possible indicator. Long term, given the vendor's non-response, plan replacement of the NR268 with a supported platform or isolate it behind strict segmentation. Watch the researcher's write-up at https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-arp-import-overread.md and the VulDB entries at https://vuldb.com/vuln/416700 for any later vendor fix or version guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the CGI handler filter_arp_put_file_cgi bound to the endpoint /router/filter_arp_put_file.cgi, part of the router's ARP filter management feature that imports an operator-supplied file referenced by the put_file parameter. The flaw is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), which in this instance manifests as an out-of-bounds read rather than a memory write: the handler processes attacker-influenced input without adequately validating its length or bounds against the destination/reference buffer, so malformed or oversized values cause the process to read past the end of an allocated region. Netcore has historically described this class of finding under the tag "Buffer Overflow," but the practical consequence of an out-of-bounds read on an embedded router CGI process is typically disclosure of adjacent memory contents and/or an abnormal termination of the web management service, not control-flow hijacking. The CVSS 4.0 vector published with the record (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/...) is scored more severely than the independent assessment, which maps the same issue as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L - i.e., adjacent, non-scoped impact limited to low confidentiality loss (memory disclosure) and low availability loss (crash), with no integrity impact. No CPE identifiers were supplied in the source data, so the affected platform should be scoped by product name and the exact firmware build 1.7.121109.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable CGI but requires administrative auth (PR:H); an out-of-bounds read gives bounded memory disclosure (C:L) and possible crash (A:L) with no integrity impact (I:N).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A high-severity memory disclosure and denial-of-service flaw affects Netcore NR268 router firmware version 1.7.121109, and no vendor fix has been identified. Because exploitation requires an already-authenticated administrative session on the device, the practical risk is concentrated in organizations that expose router management interfaces to untrusted networks or share admin credentials broadly - those environments could see device crashes, service outages, or leakage of sensitive process memory. Leadership should treat this as a resilience and exposure-management issue for edge networking equipment rather than an imminent external breach vector.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management interface access to trusted administrative networks or allowlisted hosts, disable WAN-side/remote administration, enforce least-privilege admin accounts with unique strong credentials (exploitation requires high/administrative privileges, CVSS PR:H, and an authenticated management session), segment affected routers from sensitive internal networks, log and alert on access to /router/filter_arp_put_file.cgi and on unexpected device crashes or reboots, and plan hardware/firmware replacement if the vendor remains unresponsive.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB