CVE-2026-108909
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-352, CWE-862
Impact
Remote attackers can trick an authenticated administrator into executing unauthorized state-changing actions via cross-site request forgery. This requires tricking the user into clicking a malicious link while logged into the router web interface.
Root cause
The CGI endpoint fails to implement CSRF tokens or check request origins before executing state-changing actions.
Affected systems
Netcore NR268 version 1.7.121109.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No vendor patch is available; restrict router web management interfaces to trusted internal networks or VLANs and log out of the administration console immediately after use.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.