A buffer over-read vulnerability exists in Netcore NR268 version 1.7.121109, specifically within the filter_arp_put_file_cgi handler. By manipulating the put_file argument, an attacker can read memory beyond the intended bounds of the request payload. This can expose sensitive router state or configuration data, potentially allowing further exploitation or detailed reconnaissance of the device. The weakness is a classic out-of-bounds read, classified under CWE‑119 and CWE‑125.

The affected product is Netcore NR268, firmware 1.7.121109 and potentially earlier releases that retain the same code path. The vulnerability is exercised through the /router/filter_arp_put_file.cgi endpoint exposed on the device’s management interface.

The CVSS v3.1 score of 8.6 indicates a high impact, while no EPSS score is publicly available and the risk is not listed in CISA KEV. The most likely attack vector is a remote attacker sending a crafted HTTP request to the vulnerable CGI module, which is feasible over the Internet from any accessible management interface. Public disclosure already exists and the attacker could employ it in automated scanning or targeted attacks. Given the high severity and remote accessibility, time‑to‑patch is critical.