The flaw resides in the execvp call within the DDNSset.cgi script on Netcore NR268 routers, where the Hostname argument is not properly sanitized. Manipulating this parameter allows an attacker to inject arbitrary command arguments, resulting in the execution of unintended code on the device. This can compromise the confidentiality, integrity, and availability of the router and any network services it manages.

Devices with the Netcore NR268 model, specifically firmware version 1.7.121109, are affected. No additional affected versions are listed in the available data, so the impact remains confined to the mentioned build until the vendor releases a corrected version.

The vulnerability carries a CVSS score of 9.4, indicating critical severity. EPSS information is unavailable, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the attack can be launched remotely via the router’s web interface, relying on the ability to send crafted HTTP requests that reach DDNSset.cgi. The lack of authentication requirement or privilege checks inferred from the description suggests that any remote user with access to the management interface could exploit the flaw.