CVE-2026-108906: Out-of-Bounds Read Vulnerability in Netcore NR268 Router

• •CVE-2026-108906 affects Netcore NR268 routers, allowing remote exploitation.
• •The vulnerability can lead to sensitive data leakage through out-of-bounds reads.
• •No vendor response or patch is available, increasing the risk for affected users.

A vulnerability, CVE-2026-108906, has been identified in the Netcore NR268 router version 1.7.121109, affecting the filter_arp_put_file_cgi function. This flaw allows for an out-of-bounds read, which can be exploited remotely by an authenticated attacker. The vulnerability was publicly disclosed on October 12, 2026, and can leak sensitive information from adjacent stack memory. Users of small-office and home-office networks utilizing this router are particularly at risk, especially if the administration interface is accessible from the internet. The vendor has not responded to disclosure attempts, and no patches are currently available. Security professionals are advised to monitor for unusual requests to the ARP-filter upload function and review authentication logs for unexpected access. The risk is elevated due to the existence of public exploitation material, although the urgency of the threat is not fully calibrated due to missing KEV, SSVC, and EPSS status.