Netcore NR268: Argument injection in DDNS configuration CGI
Summary
The DDNS configuration CGI of the Netcore NR268 router firmware 1.7.121109 passes user-supplied DDNS fields such as the hostname to a root-run helper process without proper quoting. An attacker with valid login credentials can send a crafted hostname containing spaces, which splits into extra command arguments and can alter the helper invocation. Because the flaw is reachable remotely, weak or default admin credentials make exploitation considerably easier.
Affected
- Netcore NR268 router, firmware 1.7.121109 (NR268-V1.7.121109.bin)
- Endpoint: /router/DDNSset.cgi (DDNS component)
- Other firmware versions: Unknown.
Fixed in
Unknown. No fixed firmware version has been published by the vendor.
Workaround
- Disable remote web management and DDNS if not needed.
- Restrict access to the router admin interface to the LAN or a VPN.
- Block external access to /router/DDNSset.cgi with a firewall.
- Replace default or weak admin passwords.
Exploitation
- Known exploitation in the wild: Unknown.
- CISA SSVC: Exploitation none, not automatable, total technical impact.
- A public technical write-up exists; VulDB lists no available exploit.
- VulDB estimates an exploit price of USD 0-5k.
Our recommendation
- Inventory all Netcore NR268 devices and confirm the firmware version.
- Remove internet exposure of the router admin interface now and use a VPN for remote management.
- Replace default or weak admin passwords.
- Ask Netcore support for a fixed firmware version and monitor the NVD, VulDB and vendor pages.
- If no fix is available, plan to replace the device with a supported model.
- Also assess the related CVE-2026-108907 (unauthenticated auth bypass, same model) and CVE-2026-76852/76853 on the same firmware.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub draw-ctf report: NR268 DDNS argument injection github.com
- VulDB CVE-2026-108929 vuldb.com
- VulDB entry 416753 vuldb.com
- OpenCVE CVE-2026-108929 app.opencve.io
- HOL CVE-2026-108929 hol.org
- Strix CVE-2026-108929 www.strix.ai
- CVE Brief archive 2026/10/13 cvebrief.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:07.
Original description (NVD)
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.