CVE-2026-76852: Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write
Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtdwrite allowing forged firmware authenticity checks. Attackers can exploit putfile.cgi and checkimageuuid.c to bypass firmware signature validation and load unauthorized firmware images.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netcore NR268to a version that resolves this vulnerability.Fixed in 1.7.121109Patch Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vector indicates network exploitation with low attack complexity, but the attacker must have low-level privileges. No user interaction is required.
What is the likely impact if exploitation succeeds?
An attacker can bypass firmware signature validation and install an unauthorized firmware image. The reported impact includes high confidentiality, integrity, and availability consequences.
Which component paths are involved in the bypass?
The issue is described as involving put_file.cgi and check_image_uuid.c, with the flawed authenticity verification occurring in mtd_write.