CVE-2026-108932: Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting
A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filterhostsdump.cgi of the component DHCP Hostname Handler. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker can remotely manipulate the Hostname argument handled by filter_hosts_dump.cgi to trigger cross-site scripting. No authentication requirement is stated, but exploitation requires user interaction.
Which systems are known to be affected?
The affected product identified in the available information is Netcore NR268 version 1.7.121109, specifically its DHCP Hostname Handler.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
Is a vendor fix or response available?
No vendor response is reported. The vendor was contacted early about the disclosure but did not respond.