An improper authentication flaw in the user_ok function of the Netcore NR268 router's CGI Execution component lets a remote attacker get past authentication, and a public exploit has been disclosed with no response from the vendor.
What Is It
CVE-2026-108907 is an improper authentication vulnerability (CWE-287) in Netcore NR268 firmware version 1.7.121109. The bug is in the user_ok function of the CGI Execution component. Manipulating this function causes improper authentication, and the attack can be launched remotely.
VulDB, acting as the CNA, published the CVE on 2026-10-12. The NVD record is still in "Received" status, which means NVD has not yet analyzed it on its own.
Why It Matters
The CNA rates this flaw at the top of the severity scale:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 10.0
An attacker can exploit it over the network with low complexity. They need no privileges and no user interaction. Impact on confidentiality, integrity and availability is high, and the scope is changed. The exploit has been publicly disclosed and may be used.
This CVE is not in the CISA Known Exploited Vulnerabilities catalog, so KEV does not confirm active exploitation in the wild. Still, a public proof-of-concept against a no-auth, network-reachable router flaw is enough reason to act quickly.
What's Vulnerable
- Vendor: Netcore
- Product: NR268
- Affected version: 1.7.121109
- Component: CGI Execution (
user_okfunction)
The source data lists no other affected versions.
Patch Status
No patch had been released as of 2026-10-12. According to the disclosure, the vendor was contacted early but did not respond. No CISA required action exists, since this CVE is not in KEV, and the supplied records list no vendor remediation guidance.
Organizations running the NR268 on firmware 1.7.121109 should treat these devices as exposed. Until the vendor releases a fix, keep their management interfaces off untrusted networks.