CVE-2026-108907

Summary

The Netcore NR268 router has a critical authentication flaw in its CGI execution component that allows remote attackers to bypass user authentication entirely. This vulnerability can be exploited without any user interaction and affects all users of the affected firmware version.

Exploitability

The exploit is highly straightforward to execute remotely with no prerequisites, as it directly targets an authentication function without requiring any special conditions or user actions.

Blast radius

The vulnerability could impact a large number of networked devices running the affected firmware, potentially allowing attackers to gain full administrative control over thousands of routers simultaneously.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 1.7.121109 or later immediately, as this is the specific fixed version mentioned in the vulnerability description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.