Netcore NR268 CVE-2026-108931

Exploitation requires the attacker to supply a crafted Hostname value through a DHCP request handled by the NR268 DHCP service, where it is stored without sanitization. The payload only executes when an authenticated administrator opens the DHCP dynamic IP display page (dhcp_dynamicip_show.cgi) in the router's web UI - this required victim interaction (UI:P) is the primary limiting factor. Practical reachability is effectively LAN-side, since DHCP Hostname assignment is a local-network operation, which constrains exploitation to attackers with access to the router's network segment despite the AV:N labeling. Affects Netcore NR268 firmware 1.7.121109; no non-default configuration is required.

This is a low-severity stored cross-site scripting flaw (CWE-79) in the Netcore NR268 router's DHCP handler, and the signals are largely consistent in pointing to limited real-world risk. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) scores only 2.1, reflecting no confidentiality or availability impact and only low integrity impact, gated by passive user interaction (UI:P) - an administrator must view the affected page for the payload to fire. The exploit code has been made public (E:P), so publicly available exploit code exists, but the CVE is NOT on the CISA KEV list and no EPSS score is provided in the input, so there is no evidence of active or widespread exploitation. The low CVSS, dependence on victim interaction, and absence of KEV status together indicate this is a genuine-but-low-priority issue rather than an urgent threat. One caveat to verify: the vector asserts PR:N and AV:N, yet the injection path (a DHCP Hostname) is typically a LAN-side operation, so 'network' reachability in practice likely means an attacker already on the local network segment - defenders should treat the attack surface as LAN-adjacent rather than internet-facing unless the admin interface is remotely exposed.

An attacker with access to the local network submits a DHCP request containing a malicious Hostname value carrying a JavaScript payload, which the NR268 stores. When an administrator later opens the DHCP dynamic IP listing (dhcp_dynamicip_show.cgi) in the router's web interface, the unsanitized Hostname is rendered and the script executes in the admin's browser session. Public exploit code exists for this vulnerability, lowering the skill barrier to reproduce the attack.