CVE-2026-108930
2.7LowPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-200, CWE-284
Impact
Authenticated remote administrators can view sensitive DDNS credentials exposed by the web interface. Attackers require network access and high-privilege credentials to exploit this.
Root cause
The ddns_wan_list_show.cgi handler leaks user_idN and passwordN parameter values directly into the response.
Affected systems
Netcore NR268 1.7.121109
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
No vendor patch is available; restrict network access to the router's web management interface to trusted admin IPs or disable remote management entirely.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the component DDNS Handler. The manipulation of the argument user_idN/passwordN leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.