CVE-2026-108929 is a critical argument injection flaw in the DDNS component of Netcore NR268 firmware 1.7.121109. It can be exploited remotely through the Hostname parameter.
What Is It
The flaw is in the execvp function call in /router/DDNSset.cgi, which belongs to the router's DDNS component. An attacker who manipulates the Hostname argument can inject arguments. VulDB, which assigned the CVE, mapped it to two weaknesses: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, or "Injection") and CWE-88 (Improper Neutralization of Argument Delimiters in a Command, or "Argument Injection").
VulDB published the record on 2026-10-12. Its NVD status is "Received," which means NVD has not yet completed its own analysis.
Why It Matters
VulDB scores this vulnerability 9.9 (CRITICAL) under CVSS 3.1, with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In practice:
- Can be attacked over the network: the attacker doesn't need physical access to the router.
- Easy to pull off: no special conditions are required.
- Needs a login: the attacker must have some level of authenticated access.
- No user interaction: a victim does not need to do anything.
- Reaches beyond the bug itself: the damage can spread past the vulnerable component. An attacker could read data, change it, or knock services offline.
The CVSS 4.0 score is 9.4 (CRITICAL) and the CVSS 2.0 score is 9.0, with single authentication required.
The record references a public write-up (draw-ctf report). As of this writing, CVE-2026-108929 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation.
What's Vulnerable
- Vendor: Netcore
- Product: NR268
- Component: DDNS (
/router/DDNSset.cgi) - Affected version: 1.7.121109
The record does not say whether other firmware versions are affected.
Patch Status
The available records don't mention a vendor patch, advisory or fixed firmware version. Because there is no KEV entry, CISA has not set a required action or deadline.
Until the vendor publishes guidance, owners of NR268 devices running 1.7.121109 should:
- Assume that anyone who can log in and reach the DDNS settings page can use the Hostname field to slip extra arguments into a command the router runs.
- Limit who can log in to the router's management interface.
- Watch the VulDB entries below for updates.