Netcore NR268 EUVD-2026-97569

Exploitation requires an authenticated administrator with a valid, active session to the NR268 web/CGI interface to visit an attacker-controlled page while logged in (UI:P / user interaction required) - this is the core limiting factor and reduces realistic risk below the raw network-reachable rating. No attacker authentication to the device is needed (PR:N), and no special non-default configuration is called out in the description, but the attack fails if the admin has no active session, if the CGI interface is not exposed to the admin's browser, or if anti-CSRF tokens/SameSite cookie protections are in place. Impact is limited to unauthorized state-changing actions on the device (low integrity); no data disclosure or denial of service is indicated.

This is a low-priority issue despite being publicly exploitable. The CVSS 4.0 base score of 2.1 reflects the limited technical impact: the vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) shows a network-reachable, low-complexity attack requiring no privileges, but it achieves only a LOW integrity impact (VI:L) with NO confidentiality (VC:N) or availability (VA:N) impact and no scope change to subsequent systems. Crucially, exploitation depends on victim user interaction (UI:P), which is inherent to CSRF (CWE-352) - an authenticated operator must be lured into triggering the forged request. POC/exploit code is publicly available (reported by VulDB, with a GitHub exploit writeup), so the barrier to weaponization is low, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation. The signals are therefore internally consistent: a genuine, easily-reproduced flaw but with narrow impact and a mitigating user-interaction requirement. This is a 'low-CVSS, real-but-limited' issue rather than an urgent priority. Note the vendor was contacted and did not respond, so no official patch is confirmed - remediation currently depends on compensating controls rather than a vendor fix.

An attacker hosts a malicious web page containing a forged request targeting a CGI endpoint on the Netcore NR268 router. When an authenticated administrator with an active session visits the page, the browser silently submits the request, causing an unauthorized state-changing action (low-integrity impact) on the device. Public exploit code for this CSRF flaw already exists, lowering the effort required to reproduce the attack.