Netcore NR268: Authentication bypass in CGI web interface
Summary
Netcore NR268 routers running firmware 1.7.121109 fail open in the Boa web server's authentication when the credential cache /tmp/passwd is missing or malformed. A remote attacker can send arbitrary HTTP Basic credentials to the /router/*.cgi endpoints and reach the CGI execution path, including privileged write actions such as reboot, factory reset or firmware upload, according to the published write-up. A public exploit reference exists, and the vendor did not respond to early disclosure.
Affected
- Netcore NR268 router, firmware 1.7.121109 (NR268-V1.7.121109.bin)
- Other firmware versions: Unknown.
Fixed in
Unknown. No vendor advisory or patch found.
Workaround
- Restrict network access to the web management interface to trusted administrators only (for example via VPN or trusted admin hosts).
- No firmware-level workaround known.
Exploitation
- Public exploit reference: yes (per sources, GitHub write-up and VulDB).
- CISA SSVC: exploitation status poc, automatable yes, technical impact total.
- Exploited in the wild: No evidence found.
Our recommendation
- Identify all NR268 devices and confirm the firmware version.
- Remove any internet-facing access to the web management interface and limit it to trusted admin hosts or a VPN.
- Monitor Netcore support channels for a fix; a patch may not be released.
- If compromise is suspected, treat the device as untrusted, check for unexpected configuration or firmware changes, and consider replacing it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub write-up (draw-ctf) github.com
- VulDB CVE-2026-108907 vuldb.com
- VulDB vulnerability 416702 vuldb.com
- VulDB submission 977173 vuldb.com
- HOL Guard CVE-2026-108907 hol.org
- CVE Brief archive 2026/10/13 cvebrief.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:30.
Original description (NVD)
A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.