CVE-2026-108929

CRITICAL

A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.

CVSS v3.1 Score

9.9
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 10/12/2026Modified: 10/16/2026

Related Intelligence (0)

No articles currently reference this CVE.

References (5)

https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-ddns-argument-injection.mdhttps://vuldb.com/cve/CVE-2026-108929https://vuldb.com/submit/977178https://vuldb.com/vuln/416753https://vuldb.com/vuln/416753/cti