Description
A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 10 Critical
EPSS: 1.2% Low
KEV: No
Impact: Authentication bypass
Action: Assess Impact
AI Analysis

Impact

In Netcore NR268 1.7.121109 the function user_ok in the CGI Execution component has been found to allow attackers to manipulate authentication checks. This improper authentication (CWE-287) means that legitimate credential verification can be bypassed, granting unauthorized access to web application resources. The description does not confirm that the flaw enables further actions beyond access, but it can potentially allow an attacker to exploit the system once access is gained.

Affected Systems

The vendor Netcore is affected, specifically its NR268 product, version 1.7.121109. No other versions or additional products were listed as vulnerable.

Risk and Exploitability

The flaw scores a CVSS of 10, indicating critical severity. EPSS score is 1%, and the vulnerability is not listed in the CISA KEV catalog, but the attack can be initiated remotely, making it highly attractive for exploitation. Because no patch or workaround has been released, the risk remains high and the likelihood of an attacker successfully exploiting the flaw is uncertain but potentially significant.

Generated by OpenCVE AI on October 13, 2026 at 15:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available vendor patch for Netcore NR268 once it is released
  • Restrict remote access to the CGI execution endpoint using firewall rules or IP whitelisting until the patch is applied
  • Augment log monitoring for authentication attempts and configure alerts for anomalous activity

Generated by OpenCVE AI on October 13, 2026 at 15:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title Netcore NR268 CGI Execution user_ok improper authentication
First Time appeared Netcore
Netcore nr268
Weaknesses CWE-287
CPEs cpe:2.3:a:netcore:nr268:*:*:*:*:*:*:*:*
Vendors & Products Netcore
Netcore nr268
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Netcore Nr268
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T16:24:18.568Z

Reserved: 2026-10-11T14:55:14.375Z

Link: CVE-2026-108907

cve-icon Vulnrichment

Updated: 2026-10-13T16:24:11.676Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T17:17:13.373

Modified: 2026-10-13T17:17:21.750

Link: CVE-2026-108907

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T15:15:15Z

Weaknesses