EUVD-2026-97677
GHSA-382f-xr7m-w8hq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web/CGI interface
-
DeliverySend crafted request to user_ok
-
ExploitAuthentication logic fails open
-
ExecutionGain unauthenticated privileged access
-
ImpactAlter config or take over device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the NR268's web management/CGI interface (the Boa-based HTTP service) and a request that invokes the vulnerable user_ok function, which fails open and bypasses authentication - no credentials, no user interaction, and no non-default configuration are needed per the CVSS vector (PR:N/UI:N/AC:L). The practical limiting factor is exposure: risk is high where the management interface is reachable from untrusted networks (WAN-exposed or shared LAN) and substantially lower where management is restricted to a trusted internal interface. Affected build is specifically NR268 firmware 1.7.121109; no vendor patch is available. |
| Impact | Signals are mostly consistent toward elevated but not panic-level risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw with high vulnerable-system confidentiality, integrity, and availability impact (base 9.3), which aligns well with a CWE-287 authentication 'fail-open' in the device's CGI/Boa web interface. A public proof-of-concept exists (reflected in the vector's E:P and the VulDB-linked GitHub report), raising practical exploitability above a purely theoretical finding. However, this is NOT CISA KEV-listed and there is no evidence of active in-the-wild exploitation, and no EPSS probability was provided in the input - so the likelihood signal is incomplete and should not be treated as 'widespread exploitation confirmed.' The provided vector also asserts subsequent-system impact (SC:H/SI:H/SA:H), which for a self-contained SOHO router auth bypass is debatable and inflates the score; the realistic impact is full compromise of the device itself. Net: a genuinely serious unauthenticated auth bypass with a public PoC, but tempered by a niche product footprint, an unresponsive vendor (no patch), and absence of KEV/EPSS corroboration - prioritize for affected deployments rather than treating as a broad emergency. |
| Exploit ScenarioDerived | A remote attacker on a network path to the device's web management interface (e.g. an Internet-exposed or LAN-adjacent NR268 router) sends a crafted request that triggers the flawed user_ok authentication routine in the CGI handler, causing it to fail open and grant access without valid credentials. A public PoC/write-up exists (GitHub 'netcore-nr268-boa-auth-fail-open'), lowering the skill barrier. Once past authentication the attacker reaches privileged device functions, enabling configuration changes, traffic interception, or full device takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 12, 2026
Improper authentication in the CGI handling of Netcore NR268 firmware 1.7.121109 allows remote, unauthenticated attackers to bypass authentication on the device's Boa-based web management interface via the user_ok function, which fails open rather than denying the request. Publicly available exploit code exists (a detailed report is published on GitHub), and the vendor was contacted but did not respond or release a fix. Exposure is the practical risk driver: devices whose HTTP management/CGI interface is reachable from the WAN or an untrusted LAN segment are at high risk, while deployments restricting management to a trusted internal interface are substantially lower risk.
Earlier versions of this analysis (1)
Unauthenticated authentication bypass in the Netcore NR268 router (firmware 1.7.121109) lets any remote attacker who can reach the device's Boa HTTP management interface take full administrative control of the device without credentials or user interaction. The flaw sits in the user_ok CGI authentication routine, which fails open, so requests that should be rejected are instead treated as authenticated; publicly available exploit code exists (a detailed technical write-up is hosted on GitHub), and the vendor was contacted but did not respond, so no vendor patch has been identified at time of analysis. With a CVSS 4.0 base score of 10.0 and an independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, the practical risk is governed almost entirely by exposure: the interface is reachable on the LAN by default, and becomes internet-exploitable only where remote administration is enabled or the management port is forwarded to the WAN side.
RemediationAI
No vendor-released patch has been identified at time of analysis: Netcore was notified early about the disclosure but did not respond, and no fixed firmware version for the NR268 is documented in the references. Because remediation cannot rely on an upgrade, treat network isolation as the primary control. Do not expose the NR268 web management/CGI interface (the Boa HTTP service) to the WAN - disable remote/web administration from the WAN side in the device configuration and, where the firmware permits, restrict management to a specific LAN interface. If WAN management cannot be disabled, place the device behind a firewall rule that blocks inbound access to its HTTP/CGI ports and require VPN access for administration; the trade-off is that legitimate remote management must be performed through the VPN tunnel. Segment the NR268 onto a dedicated management VLAN so that a compromised or bypassed interface cannot be reached laterally from general user networks, accepting the added VLAN/routing complexity. Restrict management to trusted administrative source IPs via ACLs where supported, noting this does not remediate the fail-open flaw itself - it only reduces reachability. Audit devices for signs of prior exploitation (unexpected configuration changes, new admin accounts, altered routing or DNS settings) regardless of mitigation, since the authentication bypass gives full read/write control. Continue monitoring the VulDB entry (https://vuldb.com/vuln/416702) and the public exploit report for updated vendor guidance, and plan replacement of the device if Netcore remains unresponsive, as an authentication bypass of this class is unlikely to be mitigated by configuration alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Netcore NR268 router exposes an embedded Boa HTTP server that dispatches administrative actions through CGI binaries. The vulnerable component is the authentication routine user_ok within that CGI execution path, which is classified as CWE-287 (Improper Authentication). Rather than denying access when credentials are absent or invalid, the routine fails open - the authentication check returns a permissive result, so the request proceeds into privileged functionality. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, E:P) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) agree that no credentials, no user interaction, and no non-default configuration are required, giving full confidentiality, integrity, and availability impact on the device. CPE cpe:2.3:a:netcore:nr268:*:*:*:*:*:*:*:* tracks the NR268 product line generally, with the disclosed affected build being 1.7.121109.
Know when Nr268 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Remote, low-complexity, unauthenticated auth bypass (AV:N/AC:L/PR:N/UI:N) yielding full control of the device, so C/I/A:H; scope unchanged as impact stays within the router itself.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Technical POC Analysis
CWE-287: Improper Authentication in the Netcore NR268 Boa web management CGI path.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Netcore NR268 devices running firmware 1.7.121109 are exposed to a critical authentication bypass in the web management interface, and publicly available exploit code exists with no vendor-released patch identified at time of analysis. For organizations with these devices reachable from the WAN or untrusted LAN segments, an attacker could gain administrative control of the device, potentially disrupting network operations, intercepting or altering traffic, and using the device as a pivot into internal networks. Leadership should treat internet- or untrusted-network-exposed units as urgent, while deployments with management strictly limited to a trusted internal interface face substantially lower risk.
No vendor-released patch identified at time of analysis; restrict management interface to a trusted internal network or VPN, block WAN and untrusted LAN access to HTTP/CGI, disable remote management, segment the device, and monitor for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Argument injection in the DDNS configuration handler of the Netcore NR268 consumer router (firmware 1.7.121109) lets an
Stored cross-site scripting in the Netcore NR268 router running firmware 1.7.121109 allows an attacker with a presence o
Cross-site request forgery in the CGI endpoint of the Netcore NR268 router (firmware 1.7.121109) allows an attacker to r
Stored DDNS account credentials on Netcore NR268 routers running firmware 1.7.121109 are disclosed through the DDNS Hand
Stored cross-site scripting (CWE-79) in the Netcore NR268 router Web UI (firmware 1.7.121109) lets an attacker who alrea
Exploit-DB