Key points
- Netcore NR268 firmware version 1.7.121109 contains a critical remote flaw.
- The vulnerability is assigned CVE-2026-108929 with a CVSS score of 9.4.
- Attackers can exploit the DDNS component via the Hostname argument.
Netcore NR268 routers running firmware version 1.7.121109 are vulnerable to a critical remote argument injection flaw. The National Vulnerability Database lists this issue as CVE-2026-108929 with a CVSS score of 9.4. Attackers can launch this attack remotely by manipulating the Hostname argument.
In plain English
The flaw exists in the Dynamic DNS feature of the router. Specifically, the file /router/DDNSset.cgi processes inputs for the Hostname field. When a user sets a hostname, the system passes this data to a command execution function. If an attacker sends a specially crafted hostname, they can inject arguments. This allows them to manipulate the arguments passed to the execvp function.
The background
The vulnerability stems from improper handling of user input in the DDNS component. The National Vulnerability Database identifies the weaknesses as CWE-88 and CWE-74. CWE-88 refers to argument injection, while CWE-74 relates to improper neutralization of special elements. These weaknesses allow the attacker to manipulate the arguments passed to the execvp function.
What changes now
Users with Netcore NR268 devices must verify their firmware version immediately. If the device runs version 1.7.121109, it is affected by this critical flaw. No patch or update has been confirmed yet according to the source material. Administrators should monitor for unusual activity related to DDNS settings.
What to do and how to stay safe: Netcore
- Check your router’s firmware version in the admin panel to see if it matches 1.7.121109.
- Disable the Dynamic DNS feature if you do not use it to reduce the attack surface.
- Isolate the router from the public internet until a vendor fix is available.
- Monitor network traffic for unusual outbound connections that could indicate compromise.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Netcore router model is affected?
The Netcore NR268 router running firmware version 1.7.121109 is affected by this vulnerability.
How severe is this vulnerability?
The flaw is rated critical with a CVSS score of 9.4 according to the National Vulnerability Database.
Is there a fix available yet?
No fix has been confirmed yet for this specific vulnerability in the provided source material.
