Nr268
Monthly
Argument injection in the DDNS configuration handler of the Netcore NR268 consumer router (firmware 1.7.121109) lets an authenticated, low-privilege user manipulate the Hostname parameter sent to /router/DDNSset.cgi, which is then passed unsanitized into an execvp call and can result in arbitrary command execution on the device. Because the CVSS vector shows PR:L, the attacker must first hold valid low-level credentials or a session on the device web interface, and the router's management interface must be reachable - exposure is far greater where the admin UI is internet-facing or default credentials remain unchanged. No vendor patch has been identified at time of analysis and no public exploit code has been confirmed, though the flaw is documented in a public GitHub write-up and a VulDB entry, making details discoverable.
Improper authentication in the CGI handling of Netcore NR268 firmware 1.7.121109 allows remote, unauthenticated attackers to bypass authentication on the device's Boa-based web management interface via the user_ok function, which fails open rather than denying the request. Publicly available exploit code exists (a detailed report is published on GitHub), and the vendor was contacted but did not respond or release a fix. Exposure is the practical risk driver: devices whose HTTP management/CGI interface is reachable from the WAN or an untrusted LAN segment are at high risk, while deployments restricting management to a trusted internal interface are substantially lower risk.
Stored cross-site scripting in the Netcore NR268 router running firmware 1.7.121109 allows an attacker with a presence on the device's local/broadcast network to plant a malicious DHCP hostname that later executes as script in the browser of an administrator who views the DHCP host-dump page rendered by filter_hosts_dump.cgi. The DHCP hostname is persisted by the router and only fires on subsequent admin page views, so successful exploitation pairs local-network access to inject the value with the passive step of the administrator opening the affected page; no authentication on the router itself is needed. Publicly available exploit code exists in the form of a detailed GitHub proof-of-concept report, and the vendor was contacted about the disclosure but did not respond; impact is confined to script execution in the administrator's session (integrity-low, with no demonstrated confidentiality or availability loss).
Stored DDNS account credentials on Netcore NR268 routers running firmware 1.7.121109 are disclosed through the DDNS Handler endpoint ddns_wan_list_show.cgi (function ddns_wan_list_show), which returns the user_idN and passwordN values for configured dynamic DNS providers. Exploitation requires an already-authenticated session with high (administrative) privileges on the web management interface (CVSS vector PR:H), so the flaw is primarily a credential-exposure issue for attackers who have already obtained admin access rather than a direct path to compromise; there is no integrity or availability impact and confidentiality loss is limited. Publicly available exploit code exists - a proof-of-concept write-up is hosted on GitHub - but there is no indication of active exploitation (not listed in CISA KEV), and the assessed CVSS 3.1 score is 4.9-equivalent impact-wise with a base of AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, making this a low-priority issue despite the remote reachability and public disclosure.
Cross-site request forgery in the CGI endpoint of the Netcore NR268 router (firmware 1.7.121109) allows an attacker to ride an authenticated administrator's active browser session and silently submit unauthorized state-changing requests to the device. Publicly available exploit code exists, but exploitation requires the logged-in admin to visit an attacker-controlled page while a valid session is open, which materially limits realistic risk; the independent assessment rates this low-priority (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) with impact confined to low-integrity configuration changes and no data disclosure or denial of service. No vendor-released patch has been identified at time of analysis, and the vendor did not respond to the disclosure.
Stored cross-site scripting (CWE-79) in the Netcore NR268 router Web UI (firmware 1.7.121109) lets an attacker who already holds a privileged, authenticated session write malicious markup through the title, note, URL, or content arguments processed by /router/l7_call_board_user_set.cgi, which is later rendered in another Web UI user's browser. Publicly available exploit code exists (documented in a GitHub report linked from the VulDB entry), but the practical blast radius is small: the payload only executes when a victim subsequently loads the affected call-board page, and the assessed impact is limited to low integrity with no confidentiality or availability effect (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; CVSS 4.0 base 1.9). The vendor was contacted about the disclosure and did not respond, so no vendor-released patch has been identified at time of analysis.
Argument injection in the DDNS configuration handler of the Netcore NR268 consumer router (firmware 1.7.121109) lets an authenticated, low-privilege user manipulate the Hostname parameter sent to /router/DDNSset.cgi, which is then passed unsanitized into an execvp call and can result in arbitrary command execution on the device. Because the CVSS vector shows PR:L, the attacker must first hold valid low-level credentials or a session on the device web interface, and the router's management interface must be reachable - exposure is far greater where the admin UI is internet-facing or default credentials remain unchanged. No vendor patch has been identified at time of analysis and no public exploit code has been confirmed, though the flaw is documented in a public GitHub write-up and a VulDB entry, making details discoverable.
Improper authentication in the CGI handling of Netcore NR268 firmware 1.7.121109 allows remote, unauthenticated attackers to bypass authentication on the device's Boa-based web management interface via the user_ok function, which fails open rather than denying the request. Publicly available exploit code exists (a detailed report is published on GitHub), and the vendor was contacted but did not respond or release a fix. Exposure is the practical risk driver: devices whose HTTP management/CGI interface is reachable from the WAN or an untrusted LAN segment are at high risk, while deployments restricting management to a trusted internal interface are substantially lower risk.
Stored cross-site scripting in the Netcore NR268 router running firmware 1.7.121109 allows an attacker with a presence on the device's local/broadcast network to plant a malicious DHCP hostname that later executes as script in the browser of an administrator who views the DHCP host-dump page rendered by filter_hosts_dump.cgi. The DHCP hostname is persisted by the router and only fires on subsequent admin page views, so successful exploitation pairs local-network access to inject the value with the passive step of the administrator opening the affected page; no authentication on the router itself is needed. Publicly available exploit code exists in the form of a detailed GitHub proof-of-concept report, and the vendor was contacted about the disclosure but did not respond; impact is confined to script execution in the administrator's session (integrity-low, with no demonstrated confidentiality or availability loss).
Stored DDNS account credentials on Netcore NR268 routers running firmware 1.7.121109 are disclosed through the DDNS Handler endpoint ddns_wan_list_show.cgi (function ddns_wan_list_show), which returns the user_idN and passwordN values for configured dynamic DNS providers. Exploitation requires an already-authenticated session with high (administrative) privileges on the web management interface (CVSS vector PR:H), so the flaw is primarily a credential-exposure issue for attackers who have already obtained admin access rather than a direct path to compromise; there is no integrity or availability impact and confidentiality loss is limited. Publicly available exploit code exists - a proof-of-concept write-up is hosted on GitHub - but there is no indication of active exploitation (not listed in CISA KEV), and the assessed CVSS 3.1 score is 4.9-equivalent impact-wise with a base of AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, making this a low-priority issue despite the remote reachability and public disclosure.
Cross-site request forgery in the CGI endpoint of the Netcore NR268 router (firmware 1.7.121109) allows an attacker to ride an authenticated administrator's active browser session and silently submit unauthorized state-changing requests to the device. Publicly available exploit code exists, but exploitation requires the logged-in admin to visit an attacker-controlled page while a valid session is open, which materially limits realistic risk; the independent assessment rates this low-priority (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) with impact confined to low-integrity configuration changes and no data disclosure or denial of service. No vendor-released patch has been identified at time of analysis, and the vendor did not respond to the disclosure.
Stored cross-site scripting (CWE-79) in the Netcore NR268 router Web UI (firmware 1.7.121109) lets an attacker who already holds a privileged, authenticated session write malicious markup through the title, note, URL, or content arguments processed by /router/l7_call_board_user_set.cgi, which is later rendered in another Web UI user's browser. Publicly available exploit code exists (documented in a GitHub report linked from the VulDB entry), but the practical blast radius is small: the payload only executes when a victim subsequently loads the affected call-board page, and the assessed impact is limited to low integrity with no confidentiality or availability effect (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; CVSS 4.0 base 1.9). The vendor was contacted about the disclosure and did not respond, so no vendor-released patch has been identified at time of analysis.