Netcore NR268’s DDNS handler exposes sensitive data through the function ddns_wan_list_show in the ddns_wan_list_show.cgi script. By manipulating the user_idN and passwordN parameters, an attacker can retrieve confidential information. The vulnerability can be triggered remotely, which means that an adversary need not be physically present to exploit it. The flaw has already been reported publicly and an attack method is known.

The affected product is Netcore NR268, version 1.7.121109. Devices running this firmware contain the vulnerable DDNS handler and the ddns_wan_list_show.cgi endpoint.

With a CVSS score of 5.1 the risk is moderate, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. An attacker who can reach the device over the network can manipulate the exposed parameters to obtain non‑authentication information, potentially leaking user credentials or configuration details. The lack of access control (CWE‑284) combined with information exposure (CWE‑200) increases the potential impact to confidentiality of any user data stored or transmitted by the DDNS service.