CVE-2026-108908: Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting
A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7callboarduserset.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access and conditions are required for exploitation?
The attack can be launched remotely, but the severity vector indicates the attacker needs high privileges and requires user interaction. Successful exploitation affects integrity, with no confidentiality or availability impact indicated.
Is public exploit code available?
Yes. The exploit is publicly available and may be used.
Which systems are specifically identified as affected?
Netcore NR268 version 1.7.121109 is identified as affected. The provided information does not establish whether other versions are affected.
What is known about vendor response or remediation?
The vendor was contacted early about the disclosure but did not respond. The provided data does not identify a vendor patch or workaround.