CVE-2026-108932
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79, CWE-94
Impact
Remote attackers can execute cross-site scripting attacks against administrators viewing DHCP leases by sending a malicious hostname. The attacker requires network access to the DHCP service and user interaction from an admin viewing the web interface.
Root cause
The filter_hosts_dump.cgi script passes untrusted DHCP hostname parameters directly into an eval call without sanitization.
Affected systems
Netcore NR268 1.7.121109
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No patch is available as the vendor did not respond. Restrict administrative web access to trusted internal IP addresses and isolate untrusted devices from the router's local DHCP network.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filter_hosts_dump.cgi of the component DHCP Hostname Handler. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.