CVE-2026-108908
2.4LowPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79, CWE-94
Impact
Authenticated attackers with high privileges can trigger cross-site scripting against other users who view the router web interface. They need administrative access to submit malicious payloads into the call board settings.
Root cause
The web UI script /router/l7_call_board_user_set.cgi insecurely passes user-supplied input parameters directly into an eval call without sanitization.
Affected systems
Netcore NR268 version 1.7.121109.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No vendor patch is available; restrict network access to the router management interface to trusted administrative IPs and avoid opening web UI sessions across untrusted networks.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7_call_board_user_set.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.