CVE-2026-108929: Netcore NR268 DDNS DDNSset.cgi execvp argument injection
Published Oct 12, 2026
·Updated
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.
Affected Software
1 affected component
Netcore NR268=1.7.121109
Event History
Oct 12, 2026
CVE Published
via MITRE·08:30 PM
Data Sourced
via MITRE·08:30 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attack can be launched remotely, but the CVSS vector indicates low privileges are required. No user interaction is required.
2
Which component and input should be prioritized for review?
The affected path is /router/DDNSset.cgi in the DDNS component. The vulnerable input is the Hostname argument passed to execvp.
3
What is the potential impact of successful exploitation?
The supplied severity vector indicates high impact to confidentiality, integrity, and availability, with scope changed.