Description
Netcore NR268 firmware version 1.7.121109 contains a security check bypass vulnerability in the parame_put_file.cgi restore archive prefix validation. Attackers can exploit the flawed prefix check in put_parame_file_cgi.c to bypass restricted restore archive handling.
Published: 2026-09-15
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Unrestricted firmware upgrade enabling potential system compromise
Action: Apply Patch
AI Analysis

Impact

The flaw lies in the parame_put_file.cgi restore archive prefix validation. Attackers can inject a malicious archive that bypasses the security check in put_parame_file_cgi.c, allowing them to restore files that should be disallowed. This could result in the installation of malicious firmware or configuration files, giving an attacker elevated control over the device.

Affected Systems

Netcore NR268 routers running firmware version 1.7.121109. No other versions are known to be affected as of the latest advisory.

Risk and Exploitability

The CVSS score of 7.2 indicates high severity. The EPSS score is below 1%, showing a low but non‑zero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploit kits. The likely attack path involves sending specially crafted requests to the parame_put_file.cgi endpoint via the device’s web interface. Successful exploitation would allow the attacker to upload a crafted archive and activate it as a restore operation, effectively modifying system firmware.

Generated by OpenCVE AI on September 16, 2026 at 20:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to a firmware version that includes a fixed prefix validation check.
  • If an update is not available, disable or restrict access to the parame_put_file.cgi restore endpoint through firewall rules or device configuration.
  • Regularly review device logs for unusual restore attempts and verify that no unauthorized archives are present.

Generated by OpenCVE AI on September 16, 2026 at 20:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description Netcore NR268 firmware version 1.7.121109 contains a security check bypass vulnerability in the parame_put_file.cgi restore archive prefix validation. Attackers can exploit the flawed prefix check in put_parame_file_cgi.c to bypass restricted restore archive handling.
Title Netcore NR268 1.7.121109 Security Check Bypass in parame_put_file.cgi
Weaknesses CWE-353
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}

cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-16T19:08:16.783Z

Reserved: 2026-08-19T21:47:08.935Z

Link: CVE-2026-76853

cve-icon Vulnrichment

Updated: 2026-09-16T19:08:12.511Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T22:16:59.070

Modified: 2026-09-16T20:21:01.047

Link: CVE-2026-76853

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T20:45:05Z

Weaknesses
  • CWE-353

    Missing Support for Integrity Check