Netcore NR268 CVE-2026-108908

Exploitation requires a privileged/authenticated session to the NR268 Web UI in order to write to the call board via /router/l7_call_board_user_set.cgi (one of the title, note, URL, or content arguments), consistent with PR:H in the CVSS 4.0 vector. The payload is stored and only triggers when a victim user subsequently loads the affected Web UI page, so UI:P (passive user interaction by the victim) is a hard prerequisite. Limiting factors: the attacker must already hold the injection privilege, impact is confined to the victim's browser context with only low integrity effect (no data exfiltration or availability impact stated), and there is no indication the sink is reachable unauthenticated.

This is a low-priority issue despite being remotely reachable. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N) scores only 1.9, and the signals are internally consistent: it is a stored cross-site scripting (CWE-79) flaw that requires high privileges (PR:H) to inject the payload and passive victim interaction (UI:P) to fire it, with only low integrity impact (VI:L) and no confidentiality or availability impact. Exploitation status is 'publicly available exploit code exists' - a GitHub write-up/exploit is referenced - but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation; POC availability must not be conflated with exploitation in the wild. The reporter is VulDB (a vulnerability database aggregator), not the vendor; the vendor was contacted and did not respond, so no vendor advisory or patch exists. The one tension worth flagging: the CGI endpoint is named 'l7_call_board_user_set', which could imply a lower-privilege user-facing function, yet the vector assigns PR:H - verify the actual privilege needed to reach the sink, as this materially affects real risk. SSVC-style framing: not automatable, partial/low technical impact, exploitation only 'public' (POC) rather than 'active' - this belongs in routine, not emergency, remediation.

An attacker with authenticated privileged access to the NR268 web UI submits a crafted value in the title, note, URL, or content parameter of /router/l7_call_board_user_set.cgi, storing a malicious script in the call board. When another operator subsequently views the affected Web UI page, the stored script executes in their browser session. A public exploit/write-up exists (draw-ctf report on GitHub), lowering the effort to reproduce.