Netcore NR268 Router Has Critical Remote Auth Bypass Vulnerability CVE-2026-108907
Netcore NR268 firmware 1.7.121109 contains a critical improper authentication flaw in CGI execution that allows remote attacks.
Key points
- CVE-2026-108907 allows remote attackers to bypass authentication on Netcore NR268 devices.
- The National Vulnerability Database rates the flaw as critical with a CVSS score of 9.3.
- Netcore did not respond to early contact regarding this publicly disclosed exploit.
Netcore NR268 router firmware version 1.7.121109 contains a critical security flaw that allows remote attackers to bypass authentication controls. The National Vulnerability Database published records for CVE-2026-108907, detailing how the improper authentication issue compromises the device’s CGI Execution component.
At a glance
- CVE
- CVE-2026-108907
- Product
- Netcore NR268
- CVSS
- 10 Critical
- Weakness
- improper authentication
- Exploited
- No known exploitation
The vulnerability resides specifically within the user_ok function of the CGI Execution component. Attackers can initiate the exploit remotely to manipulate the authentication process. The National Vulnerability Database lists two severity ratings for this issue, with one record citing a CVSS score of 9.3 and another citing 10. Both ratings classify the threat level as critical according to standard scoring metrics.
Context and Background
The exploit for CVE-2026-108907 has been publicly disclosed and is available for use. The National Vulnerability Database notes that the vulnerability is associated with CWE-287, which refers to improper authentication weaknesses. Because the attack vector is remote, an adversary does not need local access to the device or network to attempt exploitation of this flaw.
Security researchers contacted the vendor early in the disclosure process to report the issue. The National Vulnerability Database states that Netcore did not respond in any way to these communications. The lack of vendor engagement means there is no official statement or timeline for addressing the improper authentication defect in the affected firmware version.
Who Is Affected
Only Netcore NR268 devices running firmware version 1.7.121109 are confirmed to be affected by CVE-2026-108907. Other versions of the Netcore NR268 software or other hardware models from the vendor are not listed in the National Vulnerability Database records for this specific CVE. Users of this specific firmware version remain exposed to remote authentication bypass attacks.
What should you do?
No patch or fix has been confirmed by the vendor for CVE-2026-108907. The National Vulnerability Database indicates that the vendor did not respond to initial contact. Security professionals should assume that devices running firmware 1.7.121109 are vulnerable until an official update is released and verified.
What to do and how to stay safe: Netcore
- Scan internal networks to identify any Netcore NR268 routers running firmware version 1.7.121109.
- Isolate affected devices from untrusted networks to reduce the risk of remote exploitation.
- Monitor vendor communications for any future updates or patches addressing CVE-2026-108907.
- Review firewall logs for unusual traffic patterns targeting the CGI Execution ports on affected devices.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-108907?
The National Vulnerability Database lists CVSS scores of 9.3 and 10 for this vulnerability, both classified as critical.
Is there a fix available for Netcore NR268 firmware 1.7.121109?
No fix has been confirmed yet, as the vendor did not respond to early contact about the disclosure.
How can attackers exploit this vulnerability?
Attackers can initiate the exploit remotely by targeting the user_ok function in the CGI Execution component to bypass authentication.
