Description
A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filter_hosts_dump.cgi of the component DHCP Hostname Handler. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Cross‑Site Scripting via eval in DHCP Hostname Handler
Action: Patch ASAP
AI Analysis

Impact

The flaw involves the eval function invoked in filter_hosts_dump.cgi of the Netcore NR268 DHCP Hostname Handler. Attackers can provide a crafted Hostname value that is evaluated as code, leading to cross‑site scripting when a user views the affected web interface. This allows arbitrary script execution in the context of the interface.

Affected Systems

The vulnerability is documented for Netcore NR268 firmware version 1.7.121109. Devices running this firmware and exposing the DHCP Hostname Handler component are affected. The flaw originates from manipulation of the Hostname parameter passed via DHCP packets.

Risk and Exploitability

The CVSS score of 5.3 represents moderate severity. EPSS data is not available and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is a remote attacker transmitting a DHCP packet with a malicious Hostname field to trigger the eval. The publicly disclosed exploit and lack of vendor response increase the likelihood of real‑world attacks, so remediation should be prioritized.

Generated by OpenCVE AI on October 12, 2026 at 23:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any official firmware update from Netcore that removes or sanitizes the eval call in filter_hosts_dump.cgi.
  • If a firmware update is not available, configure network devices or a DHCP server to block or reject DHCP packets that contain disallowed or suspicious characters in the Hostname field, or strip dangerous input before it reaches the CGI.
  • As an additional measure, disable or bypass the DHCP Hostname Handler functionality if possible, or modify filter_hosts_dump.cgi to remove the eval path and ensure any user input is properly escaped or otherwise prevented from executing as code.

Generated by OpenCVE AI on October 12, 2026 at 23:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filter_hosts_dump.cgi of the component DHCP Hostname Handler. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting
First Time appeared Netcore
Netcore nr268
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:netcore:nr268:*:*:*:*:*:*:*:*
Vendors & Products Netcore
Netcore nr268
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Netcore Nr268
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-14T11:47:03.103Z

Reserved: 2026-10-11T18:13:36.888Z

Link: CVE-2026-108932

cve-icon Vulnrichment

Updated: 2026-10-14T11:46:58.082Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T22:17:03.430

Modified: 2026-10-14T12:17:17.300

Link: CVE-2026-108932

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T00:00:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')