Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-108931: Netcore NR268 DHCP Handler allows remote script injection
CVE-2026-108931 · published 6 days ago
Summary
The DHCP management page on Netcore NR268 version 1.7.121109 accepts a hostname value that can be tricked into running malicious code in a user's browser. An attacker from anywhere on the network could use this to steal information or hijack sessions. Apply the vendor's security update or restrict access to the DHCP interface until a patch is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| netcore | nr268 | 1.7.121109 |
Original advisory text
Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting
A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dynamicip_show.cgi of the component DHCP Handler. The manipulation of the argument Hostname results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
- https://vuldb.com/vuln/416755 vdb-entry technical-description
- https://vuldb.com/vuln/416755/cti signature permissions-required
- https://vuldb.com/cve/CVE-2026-108931 third-party-advisory
- https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-dhcp... exploit
- https://vuldb.com/submit/977180 third-party-advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
CWE-94Code Injection
Timeline
Published12 Oct 2026
Updated16 Oct 2026
First seen12 Oct 2026
Track software like this
Free during beta