CVE-2026-108909: Netcore NR268 CGI Endpoint cross-site request forgery
A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of Netcore NR268 version 1.7.121109 are identified as affected. Because the vulnerable CGI Endpoint functionality is unspecified, the available information does not establish which particular device configurations or endpoint actions are exposed.
What does an attacker need to exploit it?
The attack can be initiated remotely and has low attack complexity, but it requires user interaction. No attacker privileges are required, consistent with a CSRF attack that causes a user to submit a manipulated request.
Is public exploit code available?
Yes. The exploit has been released publicly and may be used in attacks.
Is a vendor fix or response available?
The vendor was contacted early about the disclosure but did not respond. The provided information does not identify a patch, workaround, or fixed version.