CVE Alert: CVE-2026-108906 – Netcore

A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early this disclosure but did not respond in any way.

**Risk verdict:** Elevated risk: publicly disclosed exploitation material exists, but KEV, SSVC and EPSS status are not supplied, so urgency cannot be calibrated fully.

**Why this matters:** Successful compromise could expose sensitive device information, alter its operation or interrupt connectivity. A realistic attacker goal is to take control of the router, then use it to disrupt traffic or establish a foothold for probing reachable internal systems.

**Most likely attack path:** The vulnerable management function is remotely reachable and requires low effort, but exploitation requires high privileges; an unauthenticated internet attacker is therefore not the most likely path. No user interaction is needed, and the stated unchanged scope suggests direct effects remain on the device, though a compromised router may enable further internal reconnaissance.

**Who is most exposed:** Small-office and -office networks using this router, especially where its administration interface is reachable from the internet or shared networks.

Alert on unusual requests to the ARP-filter upload/import function, especially malformed or oversized parameters.

Review authentication and admin-session logs for unexpected privileged access.

Check for unexplained configuration changes, reboots or service crashes.

Monitor outbound connections and internal scans originating from the router.

Mitigation and prioritisation

Confirm affected deployments and seek vendor guidance; no fix is evidenced in the supplied data.

Restrict management access to trusted administrative networks; block external access to the function.

If exposure cannot be controlled, isolate or replace the device where feasible.

Test any firmware change in a representative environment; back up configuration and plan rollback.

Obtain KEV, SSVC and EPSS status before final risk ranking.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.