CVE-2026-108908

Name of the Vulnerable Software and Affected Versions Netcore NR268 version 1.7.121109

Description Cross site scripting occurs in the Web UI component due to improper handling of the title, note, URL, and content arguments within the eval() function of the '/router/l7 call board user set.cgi' endpoint. This allows a remote attacker to execute malicious scripts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/router/l7 call board user set.cgi' endpoint to minimize the risk of exploitation.