Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-108929: Netcore NR268 router allows remote command injection
CVE-2026-108929 · published today
Summary
The router’s DDNS configuration page can be tricked into running unwanted commands when a specially crafted hostname is supplied. An attacker on the network could gain control of the device or disrupt its operation. Update the router firmware to the latest version or disable the DDNS feature until a fix is applied.
Original advisory text
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostna...
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-74Injection
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published12 Oct 2026
Updated12 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-108929 · NVD
Track software like this
Free during beta