Authentication Bypass in Netcore NR268

CVE-2026-108907 is an authentication bypass vulnerability affecting Netcore NR268 version 1.7.121109. The vulnerability resides in the user_ok function within the device's CGI execution component. This flaw permits an unauthenticated, remote attacker to manipulate the authentication logic, effectively bypassing security controls. The vulnerability has been publicly disclosed and is considered exploitable in the wild. Despite prior notification, the vendor has not provided a response or a corrective update, leaving deployments of this legacy firmware vulnerable to unauthorized device access and potential takeover.

Impact

Successful exploitation of this vulnerability grants an attacker unauthorized access to the affected Netcore NR268 router. Given the CVSS v3.1 base score of 10.0, the impact includes full loss of confidentiality, integrity, and availability. Attackers can leverage this access to modify device configurations, intercept traffic, or pivot into the internal network. There are no known patches, and organizations are advised to isolate these devices from public-facing networks.

Recommendation

Prioritized actions for security teams:

• Isolate all affected Netcore NR268 devices from the public-facing internet to mitigate the risk of remote exploitation.
• Audit network logs for anomalous traffic directed at CGI-related endpoints or authentication parameters on internal Netcore hardware.
• Replace legacy hardware, such as the Netcore NR268 running firmware 1.7.121109, that no longer receives security support from the manufacturer.