CVE-2026-108931
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79, CWE-94
Impact
Remote attackers can execute cross-site scripting in an administrator's browser via a malicious DHCP hostname if the admin views the DHCP lease page. This requires network access to issue DHCP requests and an administrator to open the web management interface.
Root cause
The dhcp_dynamicip_show.cgi handler uses the eval function on unescaped DHCP Hostname values.
Affected systems
Netcore NR268 1.7.121109
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No patch is available from the vendor; restrict access to the web management interface to trusted administration subnets or isolate the router's management network.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dynamicip_show.cgi of the component DHCP Handler. The manipulation of the argument Hostname results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.