A flaw was found in Netcore NR268 version 1.7.121109, where a CGI endpoint does not properly validate CSRF protection. The defect can be triggered by manipulating the request to the endpoint, allowing an attacker to forge requests that the victim’s browser would execute. This can result in unauthorized actions being performed on behalf of the victim, potentially altering data or settings that the victim has permission to modify. The weakness is identified as CWE‑352 (Cross‑Site Request Forgery) and CWE‑862 (Missing Access Control).

Netcore NR268 1.7.121109. The vulnerability resides in an undisclosed but integral functionality of the CGI endpoint and affects any deployment of that specific product version.

The CVSS score of 5.3 indicates moderate severity. An exploit has been released publicly, but no EPSS data is available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA KEV. The attack can be initiated remotely by sending a crafted request to the CGI endpoint from an attacker’s site or by manipulating the victim’s browser. Once exploited, the attacker can execute actions that the victim is authorized to perform, leading to integrity compromise and potentially availability impact if critical operations are disrupted.