Netcore NR268 CVE-2026-108930

Exploitation requires an authenticated session with high (administrative) privileges on the NR268 web management interface; the attacker then invokes the DDNS Handler endpoint ddns_wan_list_show.cgi (function ddns_wan_list_show), which returns stored DDNS account credentials in the user_idN/passwordN parameters. Limiting factors: the attacker must already possess admin access (PR:H), only DDNS credentials are exposed (no system-wide confidentiality loss, no integrity/availability impact), and exposure is meaningful only when DDNS is actually configured with stored credentials. The endpoint is network-reachable (AV:N) and requires no user interaction (UI:N).

This is a low-priority issue despite being a publicly disclosed, remotely reachable flaw. The CVSS 4.0 base score of 2.0 is driven primarily by PR:H - exploitation requires an attacker to already hold high-privilege (administrative) access to the NR268 web interface - and by VC:L/VI:N/VA:N, meaning only a limited confidentiality loss (disclosure of stored DDNS account credentials via user_idN/passwordN) with no integrity or availability impact. Signals are internally consistent: AV:N/AC:L/UI:N indicate the endpoint is network-reachable and trivially triggered once authenticated, while E:P reflects that proof-of-concept exploit code exists. There is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. The net picture is a genuine but minor post-authentication information-disclosure bug: an already-privileged admin (or someone who has otherwise compromised the admin session) can read DDNS credentials. The main residual concern is credential reuse - exposed DDNS passwords could aid lateral movement - but the PR:H precondition makes this a secondary-impact issue rather than an urgent remediation target.

An attacker who has gained administrative access to a Netcore NR268 router (via default/weak credentials, session hijack, or another flaw) requests the ddns_wan_list_show.cgi endpoint and reads back the stored DDNS account identifiers and passwords (user_idN/passwordN) in the response. A public proof-of-concept documenting this disclosure exists on GitHub. Because PR:H is required, this is realistically a privilege-amplification/credential-harvesting step rather than an initial remote compromise.