CVE-2026-108930
Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure
- State
- Published
- Severity
- 5.1 Medium
- Published
- Oct 12, 2026
- Updated
- Oct 13, 2026
- Reserved
- Oct 11, 2026
Description
A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the component DDNS Handler. The manipulation of the argument user_idN/passwordN leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 2.7 Low | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 2.7 Low | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 3.3 Low | AV:N/AC:L/Au:M/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
NR268Netcore |
|
References
- VDB-416754 | Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosurevdb-entrytechnical-description
- VDB-416754 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-108930 | CVE Analysis and Reportthird-party-advisory
- Submit #977179 | Netcore NR268 Router NR268-V1.7.121109.bin Information Disclosurethird-party-advisory
- https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-ddns-secret-disclosure.mdbroken-linkexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.