Description
A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 10 Critical
EPSS: n/a
KEV: No
Impact: Authentication bypass
Action: Assess Impact
AI Analysis

Impact

In Netcore NR268 1.7.121109 the function user_ok in the CGI Execution component has been found to allow attackers to manipulate authentication checks. This improper authentication (CWE-287) means that legitimate credential verification can be bypassed, granting unauthorized access to web application resources. The description does not confirm that the flaw enables further actions beyond access, but it can potentially allow an attacker to exploit the system once access is gained.

Affected Systems

The vendor Netcore is affected, specifically its NR268 product, version 1.7.121109. No other versions or additional products were listed as vulnerable.

Risk and Exploitability

The flaw scores a CVSS of 10, indicating critical severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the attack can be initiated remotely, making it highly attractive for exploitation. Because no patch or workaround has been released, the risk remains high and the likelihood of an attacker successfully exploiting the flaw is uncertain but potentially significant.

Generated by OpenCVE AI on October 12, 2026 at 17:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available vendor patch for Netcore NR268 once it is released
  • Restrict remote access to the CGI execution endpoint using firewall rules or IP whitelisting until the patch is applied
  • Augment log monitoring for authentication attempts and configure alerts for anomalous activity

Generated by OpenCVE AI on October 12, 2026 at 17:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title Netcore NR268 CGI Execution user_ok improper authentication
First Time appeared Netcore
Netcore nr268
Weaknesses CWE-287
CPEs cpe:2.3:a:netcore:nr268:*:*:*:*:*:*:*:*
Vendors & Products Netcore
Netcore nr268
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Netcore Nr268
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-12T16:15:10.558Z

Reserved: 2026-10-11T14:55:14.375Z

Link: CVE-2026-108907

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T17:17:13.373

Modified: 2026-10-12T17:17:13.373

Link: CVE-2026-108907

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T17:30:14Z

Weaknesses