{"id":"CVE-2026-108929","published":"2026-10-12T21:17:09.410","lastModified":"2026-10-16T18:17:29.810","description":"A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-74","CWE-88"],"vendors":[],"products":[],"references":[{"url":"https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-ddns-argument-injection.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-108929","tags":[]},{"url":"https://vuldb.com/submit/977178","tags":[]},{"url":"https://vuldb.com/vuln/416753","tags":[]},{"url":"https://vuldb.com/vuln/416753/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-ddns-argument-injection.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A critical argument injection vulnerability exists in Netcore NR268 router's DDNS component that allows remote attackers to execute arbitrary commands with high privileges. This flaw enables attackers to manipulate the Hostname parameter in the execvp function, potentially leading to complete system compromise.","exploitability":"Exploitation is relatively straightforward as it requires only a remote HTTP request to the vulnerable DDNSset.cgi endpoint with a crafted Hostname parameter, with no additional authentication needed for the initial attack vector.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full administrative control over affected routers, potentially enabling them to redirect traffic, install malware, or use the devices as launch points for broader network attacks.","remediation":"Upgrade to firmware version 1.7.121109 or later, as this is the specific fixed version mentioned in the CVE description.","detection":"Monitor for unusual HTTP requests to /router/DDNSset.cgi with suspicious Hostname parameter values that contain shell metacharacters or command chaining sequences, particularly those showing up in web server access logs.","tags":["rce","web","ics","network"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:46:42.670Z"}}