EUVD-2026-97909
GHSA-q83v-h5qh-mxfc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI (PR:L)
-
DeliverySubmit crafted Hostname to DDNSset.cgi
-
ExploitArgument injection into execvp
-
ExecutionExecute commands on router OS
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Argument sanitization
|
| Exploitation Conditions | Requires the Netcore NR268 (firmware 1.7.121109) DDNS feature to be reachable and the attacker to possess low-privilege authenticated access to the device web interface (CVSS PR:L), from which a manipulated Hostname argument is sent to /router/DDNSset.cgi. No user interaction is needed. Limiting factors: exploitation depends on network reachability of the router management interface and on holding valid (even low-level) credentials or a session - exposure is far greater where the admin interface is reachable from the WAN or default credentials remain in use; the flaw is tied to a single specific firmware build on a niche consumer router. |
| Impact | Multiple signals point to genuine high severity but with an important access caveat. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, score 9.4) indicates remote, low-complexity exploitation with no user interaction, but PR:L confirms the attacker must first hold low-level authenticated access to the router (e.g. a valid web-UI session), so this is NOT a fully unauthenticated flaw. Technical impact is maximal (VC/VI/VA:H) and the vector also claims subsequent-system impact (SC/SI/SA:H), consistent with argument injection into execvp yielding OS command execution on the device. A public technical report exists (draw-ctf GitHub writeup dated 2026-09-14) documenting the DDNS Hostname injection, so exploit-relevant detail is available even though no weaponized tool is confirmed. There is NO CISA KEV listing and NO EPSS score in the input, so widespread active exploitation cannot be asserted. Net: a real, high-severity post-authentication RCE on a niche SOHO router - prioritize for affected deployments, but the PR:L requirement and the product's limited footprint lower its mass-exploitation urgency relative to the 9.4 headline number. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the NR268 web interface (default/weak credentials or an existing session) sends a crafted request to /router/DDNSset.cgi with a malicious Hostname value. Because the value is passed into execvp without sanitization, injected arguments alter command execution and yield command execution on the router. A public technical writeup of this exact vector exists, lowering the effort to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Argument injection in the DDNS configuration handler of the Netcore NR268 consumer router (firmware 1.7.121109) lets an authenticated, low-privilege user manipulate the Hostname parameter sent to /router/DDNSset.cgi, which is then passed unsanitized into an execvp call and can result in arbitrary command execution on the device. Because the CVSS vector shows PR:L, the attacker must first hold valid low-level credentials or a session on the device web interface, and the router's management interface must be reachable - exposure is far greater where the admin UI is internet-facing or default credentials remain unchanged. No vendor patch has been identified at time of analysis and no public exploit code has been confirmed, though the flaw is documented in a public GitHub write-up and a VulDB entry, making details discoverable.
RemediationAI
No vendor-released patch identified at time of analysis; the CPE carries a wildcard version and no fixed build is referenced in the available data, so owners of the Netcore NR268 on firmware 1.7.121109 should treat the device as unpatched and monitor Netcore and the VulDB entry at https://vuldb.com/vuln/416753 for an updated firmware release before enabling any DDNS functionality. As compensating controls, restrict access to the router's web management interface so it is reachable only from the LAN and never exposed to the WAN (block external access to /router/DDNSset.cgi and the admin port at the perimeter), which removes the remote attack path but does not protect against an attacker already on the local network. Replace any default or weak administrator credentials with unique strong passwords and avoid shared low-privilege accounts, since the flaw requires only PR:L access but valid credentials are still mandatory; this raises the bar but is defeated by credential reuse or a previously compromised session. If DDNS is not operationally required, disable the DDNS feature entirely and stop using /router/DDNSset.cgi, which eliminates the vulnerable code path at the cost of losing dynamic DNS updates. For defense in depth, segment the router on an isolated management VLAN with egress filtering so that any injected command cannot reach a command-and-control server, and log/alert on unusual outbound traffic from the device; these measures contain post-exploitation impact but do not remove the underlying CWE-88 flaw, so a firmware update remains the only complete fix once one is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-88 (Argument Injection), a variant of injection where a user-controlled value is inserted into a command line without neutralization of option/flag delimiters, allowing the attacker to add or alter arguments passed to an invoked program. In this case the DDNS (Dynamic DNS) component of the Netcore NR268 firmware exposes the CGI endpoint /router/DDNSset.cgi, and the Hostname field used to register the router with a dynamic DNS provider is fed into the execvp() routine without sanitization. This means a crafted Hostname string can break out of the intended argument and inject additional arguments into the spawned process, escalating from a simple configuration input into arbitrary command execution with the privileges of the CGI process. The affected software is identified by CPE cpe:2.3:a:netcore:nr268:*:*:*:*:*:*:*:* (wildcard version, but the reported build is 1.7.121109), a single specific firmware release for a niche consumer router, which limits the population of at-risk devices while still yielding a high-impact, remotely reachable primitive once an attacker obtains any authenticated session.
Know when Nr268 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Remote, low-complexity argument injection needing a low-privilege session (PR:L); command execution on the router gives full C/I/A impact within one system (S:U).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.
Executive ViewAI
The Netcore NR268 router running firmware 1.7.121109 is affected by a critical argument injection flaw in its DDNS configuration handler that allows an authenticated low-privilege user to execute arbitrary commands on the device. Because no vendor-released patch is available and the management interface may be internet-facing or protected only by default credentials, any such devices in production, branch, or remote-worker environments should be treated as high-risk and prioritized for containment.
No vendor-released patch identified at time of analysis. Interim mitigations: remove internet-facing management access; disable remote administration and DDNS if not required; change default credentials; restrict admin UI to trusted VLAN/VPN; monitor /router/DDNSset.cgi and device logs; isolate or replace affected Netcore NR268 firmware 1.7.121109 devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Improper authentication in the CGI handling of Netcore NR268 firmware 1.7.121109 allows remote, unauthenticated attacker
Stored cross-site scripting in the Netcore NR268 router running firmware 1.7.121109 allows an attacker with a presence o
Cross-site request forgery in the CGI endpoint of the Netcore NR268 router (firmware 1.7.121109) allows an attacker to r
Stored DDNS account credentials on Netcore NR268 routers running firmware 1.7.121109 are disclosed through the DDNS Hand
Stored cross-site scripting (CWE-79) in the Netcore NR268 router Web UI (firmware 1.7.121109) lets an attacker who alrea
Exploit-DB