Netcore

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-102240	OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arbitrary commands on the device via the 'sid' parameter of the /www/cgi-bin/network_tools CGI. The vulnerability, tracked as CVE-2026-102240 (CVSS 4.0: 9.3; independent assessment CVSS 3.1: 9.8), has publicly available exploit code. The vendor was contacted but did not respond, and no fixed firmware is available.	CRITICAL	9.3	2.0%	69	PoC No patch
CVE-2026-108907	Improper authentication in the CGI handling of Netcore NR268 firmware 1.7.121109 allows remote, unauthenticated attackers to bypass authentication on the device's Boa-based web management interface via the user_ok function, which fails open rather than denying the request. Publicly available exploit code exists (a detailed report is published on GitHub), and the vendor was contacted but did not respond or release a fix. Exposure is the practical risk driver: devices whose HTTP management/CGI interface is reachable from the WAN or an untrusted LAN segment are at high risk, while deployments restricting management to a trusted internal interface are substantially lower risk.	CRITICAL	9.3	1.2%	68	PoC No patch
CVE-2026-78796	Remote code execution in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router firmware v1.3.241114.024540 and earlier is caused by OS command injection in the www/cgi-bin/upgrade handler, allowing a network attacker to run arbitrary commands through the router's HTTP management interface. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, so unauthenticated exploitation is possible when that endpoint is reachable. No CISA KEV confirmation was provided and no public exploit identified at time of analysis; EPSS is 0.24% (14th percentile), indicating low predicted exploitation activity despite the critical severity score.	CRITICAL	9.8	0.2%	49	No patch
CVE-2026-108929	Argument injection in the DDNS configuration handler of the Netcore NR268 consumer router (firmware 1.7.121109) lets an authenticated, low-privilege user manipulate the Hostname parameter sent to /router/DDNSset.cgi, which is then passed unsanitized into an execvp call and can result in arbitrary command execution on the device. Because the CVSS vector shows PR:L, the attacker must first hold valid low-level credentials or a session on the device web interface, and the router's management interface must be reachable - exposure is far greater where the admin UI is internet-facing or default credentials remain unchanged. No vendor patch has been identified at time of analysis and no public exploit code has been confirmed, though the flaw is documented in a public GitHub write-up and a VulDB entry, making details discoverable.	CRITICAL	9.4	0.4%	47	No patch
CVE-2026-111711	An unauthenticated stack-based buffer overflow in the Boa web server embedded in Netcore NR256CN firmware through 1.5.140116 lets remote attackers crash the router's main Boa process - and potentially execute code - by sending an HTTP Basic-auth username longer than 63 bytes to any password-protected /router/*.cgi route. The defect lives in the pre-authentication user_ok() handler, where Basic-auth usernames are copied with unbounded strcpy() into a fixed 64-byte stack buffer, so exploitation requires no credentials and no user interaction; the practical risk is governed almost entirely by exposure, since the attacker must be able to reach the device's HTTP management interface (far more dangerous when it faces the WAN, far less so when confined to the LAN). Per available data there is no confirmed active exploitation in CISA KEV and no public exploit code identified at time of analysis, but the zero-prerequisite access path and the network-facing attack vector make this a high-priority issue for any NR256CN with an internet-reachable admin UI.	CRITICAL	9.3	0.5%	46	No patch
CVE-2026-111710	Unauthenticated attackers with network reachability to the Boa-based web management interface of a Netcore NR256CN router (firmware through 1.5.140116) can crash the device's main Boa process by sending a Basic Authorization header whose base64-decoded value contains no colon separator - for example a value that decodes to a single character - to an auth-protected CGI route such as /router/get_user_type.cgi. The outcome is a denial of service that terminates the management interface until the web server process is restarted; per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) there is no confidentiality or integrity impact and no code execution, and real-world risk is bounded by whether the management interface is reachable outside the LAN. No vendor patch is identified in the available data and no public exploit code is confirmed at time of analysis, though the trigger itself is trivially crafted once the interface is reachable.	HIGH	8.7	0.3%	44	No patch
CVE-2026-78795	Unauthenticated information disclosure in the Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router (firmware v1.3.241114.024540 and earlier) allows a remote attacker to retrieve sensitive data from the device with no credentials and no user interaction, consistent with the supplied CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5, confidentiality-only impact). The weakness is classified as CWE-200 exposure of sensitive information; no public exploit code was identified at time of analysis, no EPSS score was supplied, and the CVE is not listed in CISA KEV, so active exploitation is not confirmed. Practical risk is bounded by deployment exposure: only the specific B11 model and firmware range is affected, and the attacker must be able to reach the router's management/web interface (for example exposed on the WAN side or from the same LAN segment).	HIGH	7.5	0.5%	38	No patch
CVE-2026-112016	Unauthenticated file write in the Boa-derived /bin/boa web server on Netcore NR256CN routers (firmware through 1.5.140116) lets remote attackers overwrite the firmware-update and configuration-restore staging files /tmp/boa_temp.update and /tmp/boa_temp.para by POSTing to a non-existent .cgi pathname. The flaw is a missing-authentication weakness (CWE-306) rated CVSS 6.9 with a PR:N/UI:N vector, but impact is bounded: writes are confined to two hardcoded temp paths, so the realistic outcomes are tampering with a pending update or configuration restore and denial of service rather than arbitrary file write or direct code execution. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and practical exposure is limited by the need for the router's management interface to be network-reachable - typically LAN-side on default deployments.	MEDIUM	6.9	0.3%	35	No patch
CVE-2026-111712	Unauthenticated attackers who can reach the management interface of a Netcore NR256CN router can bypass authentication and invoke protected management CGI handlers simply by prefixing the request URI with a recognized public route such as l7_web_auth.cgi or an .ico path. The defect affects NR256CN firmware through 1.5.140116 and is rated medium severity (CVSS 4.0 base 6.9; independent assessment CVSS 3.1 6.9, AV:N/AC:L/PR:N/UI:N), with limited confidentiality and integrity impact on router management functions and no availability impact. No public exploit code identified at time of analysis, but exploitation is a single crafted HTTP request with no credentials or user interaction required, so the practical limiting factor is whether the management interface is reachable from an untrusted network rather than any exploitation complexity.	MEDIUM	6.9	0.2%	34	No patch
CVE-2026-108932	Stored cross-site scripting in the Netcore NR268 router running firmware 1.7.121109 allows an attacker with a presence on the device's local/broadcast network to plant a malicious DHCP hostname that later executes as script in the browser of an administrator who views the DHCP host-dump page rendered by filter_hosts_dump.cgi. The DHCP hostname is persisted by the router and only fires on subsequent admin page views, so successful exploitation pairs local-network access to inject the value with the passive step of the administrator opening the affected page; no authentication on the router itself is needed. Publicly available exploit code exists in the form of a detailed GitHub proof-of-concept report, and the vendor was contacted about the disclosure but did not respond; impact is confined to script execution in the administrator's session (integrity-low, with no demonstrated confidentiality or availability loss).	LOW	2.1	0.3%	31	PoC No patch
CVE-2026-108909	Cross-site request forgery in the CGI endpoint of the Netcore NR268 router (firmware 1.7.121109) allows an attacker to ride an authenticated administrator's active browser session and silently submit unauthorized state-changing requests to the device. Publicly available exploit code exists, but exploitation requires the logged-in admin to visit an attacker-controlled page while a valid session is open, which materially limits realistic risk; the independent assessment rates this low-priority (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) with impact confined to low-integrity configuration changes and no data disclosure or denial of service. No vendor-released patch has been identified at time of analysis, and the vendor did not respond to the disclosure.	LOW	2.1	0.2%	31	PoC No patch
CVE-2026-108930	Stored DDNS account credentials on Netcore NR268 routers running firmware 1.7.121109 are disclosed through the DDNS Handler endpoint ddns_wan_list_show.cgi (function ddns_wan_list_show), which returns the user_idN and passwordN values for configured dynamic DNS providers. Exploitation requires an already-authenticated session with high (administrative) privileges on the web management interface (CVSS vector PR:H), so the flaw is primarily a credential-exposure issue for attackers who have already obtained admin access rather than a direct path to compromise; there is no integrity or availability impact and confidentiality loss is limited. Publicly available exploit code exists - a proof-of-concept write-up is hosted on GitHub - but there is no indication of active exploitation (not listed in CISA KEV), and the assessed CVSS 3.1 score is 4.9-equivalent impact-wise with a base of AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, making this a low-priority issue despite the remote reachability and public disclosure.	LOW	2.0	0.3%	30	PoC No patch
CVE-2026-102241	Configuration backups from Netcore NAP930 firmware 0.1.241010.141410 can be decrypted by an attacker who obtains a backup artifact because the Backup/Restore component uses a hard-coded AES key (the aes_pass value in /lib/functions/backup_common.sh). The issue is remotely reachable but requires high administrative privileges (PR:H) to generate or retrieve a backup, and it only affects confidentiality, exposing backup contents rather than enabling writes or code execution; publicly available exploit code exists, and the vendor did not respond to early disclosure. This is a low-to-moderate risk finding for affected deployments, scoped to the specific NAP930 firmware build.	LOW	2.0	0.2%	30	PoC No patch
CVE-2026-108908	Stored cross-site scripting (CWE-79) in the Netcore NR268 router Web UI (firmware 1.7.121109) lets an attacker who already holds a privileged, authenticated session write malicious markup through the title, note, URL, or content arguments processed by /router/l7_call_board_user_set.cgi, which is later rendered in another Web UI user's browser. Publicly available exploit code exists (documented in a GitHub report linked from the VulDB entry), but the practical blast radius is small: the payload only executes when a victim subsequently loads the affected call-board page, and the assessed impact is limited to low integrity with no confidentiality or availability effect (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; CVSS 4.0 base 1.9). The vendor was contacted about the disclosure and did not respond, so no vendor-released patch has been identified at time of analysis.	LOW	1.9	0.3%	30	PoC No patch

CVE-2026-102240

OS command injection in Netcore NAP930 firmware 0.1.241010.141410 allows unauthenticated remote attackers to execute arbitrary commands on the device via the 'sid' parameter of the /www/cgi-bin/network_tools CGI. The vulnerability, tracked as CVE-2026-102240 (CVSS 4.0: 9.3; independent assessment CVSS 3.1: 9.8), has publicly available exploit code. The vendor was contacted but did not respond, and no fixed firmware is available.

CRITICAL

9.3

2.0%

69

PoC No patch

CVE-2026-108907

Improper authentication in the CGI handling of Netcore NR268 firmware 1.7.121109 allows remote, unauthenticated attackers to bypass authentication on the device's Boa-based web management interface via the user_ok function, which fails open rather than denying the request. Publicly available exploit code exists (a detailed report is published on GitHub), and the vendor was contacted but did not respond or release a fix. Exposure is the practical risk driver: devices whose HTTP management/CGI interface is reachable from the WAN or an untrusted LAN segment are at high risk, while deployments restricting management to a trusted internal interface are substantially lower risk.

CRITICAL

9.3

1.2%

68

PoC No patch

CVE-2026-78796

Remote code execution in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router firmware v1.3.241114.024540 and earlier is caused by OS command injection in the www/cgi-bin/upgrade handler, allowing a network attacker to run arbitrary commands through the router's HTTP management interface. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, so unauthenticated exploitation is possible when that endpoint is reachable. No CISA KEV confirmation was provided and no public exploit identified at time of analysis; EPSS is 0.24% (14th percentile), indicating low predicted exploitation activity despite the critical severity score.

CRITICAL

9.8

0.2%

49

No patch

CVE-2026-108929

Argument injection in the DDNS configuration handler of the Netcore NR268 consumer router (firmware 1.7.121109) lets an authenticated, low-privilege user manipulate the Hostname parameter sent to /router/DDNSset.cgi, which is then passed unsanitized into an execvp call and can result in arbitrary command execution on the device. Because the CVSS vector shows PR:L, the attacker must first hold valid low-level credentials or a session on the device web interface, and the router's management interface must be reachable - exposure is far greater where the admin UI is internet-facing or default credentials remain unchanged. No vendor patch has been identified at time of analysis and no public exploit code has been confirmed, though the flaw is documented in a public GitHub write-up and a VulDB entry, making details discoverable.

CRITICAL

9.4

0.4%

47

No patch

CVE-2026-111711

An unauthenticated stack-based buffer overflow in the Boa web server embedded in Netcore NR256CN firmware through 1.5.140116 lets remote attackers crash the router's main Boa process - and potentially execute code - by sending an HTTP Basic-auth username longer than 63 bytes to any password-protected /router/*.cgi route. The defect lives in the pre-authentication user_ok() handler, where Basic-auth usernames are copied with unbounded strcpy() into a fixed 64-byte stack buffer, so exploitation requires no credentials and no user interaction; the practical risk is governed almost entirely by exposure, since the attacker must be able to reach the device's HTTP management interface (far more dangerous when it faces the WAN, far less so when confined to the LAN). Per available data there is no confirmed active exploitation in CISA KEV and no public exploit code identified at time of analysis, but the zero-prerequisite access path and the network-facing attack vector make this a high-priority issue for any NR256CN with an internet-reachable admin UI.

CRITICAL

9.3

0.5%

46

No patch

CVE-2026-111710

Unauthenticated attackers with network reachability to the Boa-based web management interface of a Netcore NR256CN router (firmware through 1.5.140116) can crash the device's main Boa process by sending a Basic Authorization header whose base64-decoded value contains no colon separator - for example a value that decodes to a single character - to an auth-protected CGI route such as /router/get_user_type.cgi. The outcome is a denial of service that terminates the management interface until the web server process is restarted; per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) there is no confidentiality or integrity impact and no code execution, and real-world risk is bounded by whether the management interface is reachable outside the LAN. No vendor patch is identified in the available data and no public exploit code is confirmed at time of analysis, though the trigger itself is trivially crafted once the interface is reachable.

HIGH

8.7

0.3%

44

No patch

CVE-2026-78795

Unauthenticated information disclosure in the Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router (firmware v1.3.241114.024540 and earlier) allows a remote attacker to retrieve sensitive data from the device with no credentials and no user interaction, consistent with the supplied CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5, confidentiality-only impact). The weakness is classified as CWE-200 exposure of sensitive information; no public exploit code was identified at time of analysis, no EPSS score was supplied, and the CVE is not listed in CISA KEV, so active exploitation is not confirmed. Practical risk is bounded by deployment exposure: only the specific B11 model and firmware range is affected, and the attacker must be able to reach the router's management/web interface (for example exposed on the WAN side or from the same LAN segment).

HIGH

7.5

0.5%

38

No patch

CVE-2026-112016

Unauthenticated file write in the Boa-derived /bin/boa web server on Netcore NR256CN routers (firmware through 1.5.140116) lets remote attackers overwrite the firmware-update and configuration-restore staging files /tmp/boa_temp.update and /tmp/boa_temp.para by POSTing to a non-existent .cgi pathname. The flaw is a missing-authentication weakness (CWE-306) rated CVSS 6.9 with a PR:N/UI:N vector, but impact is bounded: writes are confined to two hardcoded temp paths, so the realistic outcomes are tampering with a pending update or configuration restore and denial of service rather than arbitrary file write or direct code execution. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and practical exposure is limited by the need for the router's management interface to be network-reachable - typically LAN-side on default deployments.

MEDIUM

6.9

0.3%

35

No patch

CVE-2026-111712

Unauthenticated attackers who can reach the management interface of a Netcore NR256CN router can bypass authentication and invoke protected management CGI handlers simply by prefixing the request URI with a recognized public route such as l7_web_auth.cgi or an .ico path. The defect affects NR256CN firmware through 1.5.140116 and is rated medium severity (CVSS 4.0 base 6.9; independent assessment CVSS 3.1 6.9, AV:N/AC:L/PR:N/UI:N), with limited confidentiality and integrity impact on router management functions and no availability impact. No public exploit code identified at time of analysis, but exploitation is a single crafted HTTP request with no credentials or user interaction required, so the practical limiting factor is whether the management interface is reachable from an untrusted network rather than any exploitation complexity.

MEDIUM

6.9

0.2%

34

No patch

CVE-2026-108932

Stored cross-site scripting in the Netcore NR268 router running firmware 1.7.121109 allows an attacker with a presence on the device's local/broadcast network to plant a malicious DHCP hostname that later executes as script in the browser of an administrator who views the DHCP host-dump page rendered by filter_hosts_dump.cgi. The DHCP hostname is persisted by the router and only fires on subsequent admin page views, so successful exploitation pairs local-network access to inject the value with the passive step of the administrator opening the affected page; no authentication on the router itself is needed. Publicly available exploit code exists in the form of a detailed GitHub proof-of-concept report, and the vendor was contacted about the disclosure but did not respond; impact is confined to script execution in the administrator's session (integrity-low, with no demonstrated confidentiality or availability loss).

LOW

2.1

0.3%

31

PoC No patch

CVE-2026-108909

Cross-site request forgery in the CGI endpoint of the Netcore NR268 router (firmware 1.7.121109) allows an attacker to ride an authenticated administrator's active browser session and silently submit unauthorized state-changing requests to the device. Publicly available exploit code exists, but exploitation requires the logged-in admin to visit an attacker-controlled page while a valid session is open, which materially limits realistic risk; the independent assessment rates this low-priority (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) with impact confined to low-integrity configuration changes and no data disclosure or denial of service. No vendor-released patch has been identified at time of analysis, and the vendor did not respond to the disclosure.

LOW

2.1

0.2%

31

PoC No patch

CVE-2026-108930

Stored DDNS account credentials on Netcore NR268 routers running firmware 1.7.121109 are disclosed through the DDNS Handler endpoint ddns_wan_list_show.cgi (function ddns_wan_list_show), which returns the user_idN and passwordN values for configured dynamic DNS providers. Exploitation requires an already-authenticated session with high (administrative) privileges on the web management interface (CVSS vector PR:H), so the flaw is primarily a credential-exposure issue for attackers who have already obtained admin access rather than a direct path to compromise; there is no integrity or availability impact and confidentiality loss is limited. Publicly available exploit code exists - a proof-of-concept write-up is hosted on GitHub - but there is no indication of active exploitation (not listed in CISA KEV), and the assessed CVSS 3.1 score is 4.9-equivalent impact-wise with a base of AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, making this a low-priority issue despite the remote reachability and public disclosure.

LOW

2.0

0.3%

30

PoC No patch

CVE-2026-102241

Configuration backups from Netcore NAP930 firmware 0.1.241010.141410 can be decrypted by an attacker who obtains a backup artifact because the Backup/Restore component uses a hard-coded AES key (the aes_pass value in /lib/functions/backup_common.sh). The issue is remotely reachable but requires high administrative privileges (PR:H) to generate or retrieve a backup, and it only affects confidentiality, exposing backup contents rather than enabling writes or code execution; publicly available exploit code exists, and the vendor did not respond to early disclosure. This is a low-to-moderate risk finding for affected deployments, scoped to the specific NAP930 firmware build.

LOW

2.0

0.2%

30

PoC No patch

CVE-2026-108908

Stored cross-site scripting (CWE-79) in the Netcore NR268 router Web UI (firmware 1.7.121109) lets an attacker who already holds a privileged, authenticated session write malicious markup through the title, note, URL, or content arguments processed by /router/l7_call_board_user_set.cgi, which is later rendered in another Web UI user's browser. Publicly available exploit code exists (documented in a GitHub report linked from the VulDB entry), but the practical blast radius is small: the payload only executes when a victim subsequently loads the affected call-board page, and the assessed impact is limited to low integrity with no confidentiality or availability effect (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; CVSS 4.0 base 1.9). The vendor was contacted about the disclosure and did not respond, so no vendor-released patch has been identified at time of analysis.

LOW

1.9

0.3%

30

PoC No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (10)

Top Risky CVEs