CVE-2026-108929

Name of the Vulnerable Software and Affected Versions Netcore NR268 version 1.7.121109

Description An argument injection flaw exists in the DDNS component. A remote attacker can exploit this by manipulating the Hostname argument passed to the execvp() function within the '/router/DDNSset.cgi' endpoint.

Recommendations As a temporary workaround, restrict access to the '/router/DDNSset.cgi' endpoint or avoid using the Hostname argument until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.