CVE-2026-108930: Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure
A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddnswanlistshow of the file ddnswanlistshow.cgi of the component DDNS Handler. The manipulation of the argument useridN/passwordN leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Netcore NR268 devices running version 1.7.121109 are identified as affected. Exposure applies to the DDNS Handler endpoint implemented by ddns_wan_list_show.cgi.
What does an attacker need to exploit it?
The issue can be exploited remotely by manipulating the user_idN and passwordN arguments handled by ddns_wan_list_show. The published severity vector indicates that high privileges are required, while user interaction is not required.
What is the impact of successful exploitation?
Successful exploitation can disclose information. The supplied assessment indicates low confidentiality impact and no integrity or availability impact.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
Is a vendor fix or response available?
The available information states that the vendor was contacted but did not respond. No patch, workaround, or vendor mitigation is provided in the supplied data.