{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-108906/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:netcore:nr268:1.7.121109:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-108907"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NR268 (1.7.121109)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-108907","authentication-bypass","remote-code-execution","network-security","cve-2026-108906","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Netcore"],"content_html":"\u003cp\u003eCVE-2026-108907 is an authentication bypass vulnerability affecting Netcore NR268 version 1.7.121109. The vulnerability resides in the user_ok function within the device's CGI execution component. This flaw permits an unauthenticated, remote attacker to manipulate the authentication logic, effectively bypassing security controls. The vulnerability has been publicly disclosed and is considered exploitable in the wild. Despite prior notification, the vendor has not provided a response or a corrective update, leaving deployments of this legacy firmware vulnerable to unauthorized device access and potential takeover.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability grants an attacker unauthorized access to the affected Netcore NR268 router. Given the CVSS v3.1 base score of 10.0, the impact includes full loss of confidentiality, integrity, and availability. Attackers can leverage this access to modify device configurations, intercept traffic, or pivot into the internal network. There are no known patches, and organizations are advised to isolate these devices from public-facing networks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIsolate all affected Netcore NR268 devices from the public-facing internet to mitigate the risk of remote exploitation.\u003c/li\u003e\n\u003cli\u003eAudit network logs for anomalous traffic directed at CGI-related endpoints or authentication parameters on internal Netcore hardware.\u003c/li\u003e\n\u003cli\u003eReplace legacy hardware, such as the Netcore NR268 running firmware 1.7.121109, that no longer receives security support from the manufacturer.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:33:32Z","date_published":"2026-10-12T18:31:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-netcore-nr268-auth-bypass/","summary":"The user_ok function in the Netcore NR268 CGI execution component contains an authentication bypass vulnerability, CVE-2026-108907, which allows remote attackers to gain unauthorized access.","title":"Authentication Bypass in Netcore NR268","url":"https://feed.craftedsignal.io/briefs/2026-10-netcore-nr268-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-108906","version":"https://jsonfeed.org/version/1.1"}