Description
A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7_call_board_user_set.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting (XSS) enabling client‑side script injection via the Web UI
Action: Patch ASAP
AI Analysis

Impact

An attacker can inject malicious code via the eval function in /router/l7_call_board_user_set.cgi, exploiting a CWE‑79 (Cross‑Site Scripting) weakness and a CWE‑94 (Eval) vulnerability. The stored script is executed in browsers of other users who view the affected content, enabling session hijacking, defacement, or data theft.

Affected Systems

Netcore NR268 version 1.7.121109.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate impact. EPSS is not available and the vulnerability is not listed in CISA KEV, yet the exploit is publicly available, implying a non‑negligible risk. Because the attack vector is remote, any network‑connected device running the affected firmware can be targeted.

Generated by OpenCVE AI on October 12, 2026 at 17:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Netcore NR268 to a released version that removes or sanitizes the eval function in the Web UI; if no update exists, monitor the vendor’s release notes for a fix.
  • Configure a web application firewall or input‑sanitization rule to strip or encode JavaScript from the title, note, URL, and content fields before they are stored or displayed.
  • Restrict access to the /router/l7_call_board_user_set.cgi endpoint to trusted administrative users and implement strict authentication and role‑based access controls.

Generated by OpenCVE AI on October 12, 2026 at 17:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7_call_board_user_set.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting
First Time appeared Netcore
Netcore nr268
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:netcore:nr268:*:*:*:*:*:*:*:*
Vendors & Products Netcore
Netcore nr268
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Netcore Nr268
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-15T15:14:51.246Z

Reserved: 2026-10-11T14:55:17.819Z

Link: CVE-2026-108908

cve-icon Vulnrichment

Updated: 2026-10-15T14:50:25.548Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T17:17:13.543

Modified: 2026-10-15T16:17:39.947

Link: CVE-2026-108908

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T18:00:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')