CVE-2026-108906

CVSS 7.3 (high) · published 2026-10-12

A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness: CWE-119, CWE-125

Source: NVD CVE-2026-108906

References

• https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-arp-import-overread.md
• https://vuldb.com/cve/CVE-2026-108906
• https://vuldb.com/submit/977172
• https://vuldb.com/vuln/416700
• https://vuldb.com/vuln/416700/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.