Vulnerability · Published Oct 12, 2026 · Assigned by VulDB
CVE-2026-108929Netcore NR268 DDNS DDNSset.cgi execvp argument injection
Critical 9.9
In plain English
A critical-severity argument injection in NR268 from Netcore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.4%top 62.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.
Affected products (as reported)
Weakness: CWE-88, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R
References
- VDB-416753 | Netcore NR268 DDNS DDNSset.cgi execvp argument injection vdb-entry, technical-description
- VDB-416753 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-108929 | CVE Analysis and Report third-party-advisory
- Submit #977178 | Netcore NR268 Router NR268-V1.7.121109.bin Argument Injection third-party-advisory
- https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-ddns-argument-injection.md related