CVE-2026-108929CWE-74CWE-88

CVE-2026-108929

Critical · published October 13, 2026

CVSS v3.1
9.9
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X
EPSS
0.00429 · 36.1th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-10-13T01:17Z
References (5)
https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-ddns-argument-injection.md · [email protected]https://vuldb.com/cve/CVE-2026-108929 · [email protected]https://vuldb.com/submit/977178 · [email protected]https://vuldb.com/vuln/416753 · [email protected]https://vuldb.com/vuln/416753/cti · [email protected]
EPSS history
Timeline
  • 14 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 12 OCT 20:30Z
    Netcore NR268 DDNS DDNSset.cgi execvp argument injection
    cvelistv5
  • 12 OCT 20:30Z
    Netcore NR268 DDNS DDNSset.cgi execvp argument injection
    cvelistv5