CVE-2026-108908 Overview
CVE-2026-108908 is a stored cross-site scripting (XSS) vulnerability in the Netcore NR268 router running firmware version 1.7.121109. The flaw resides in the eval function within the /router/l7_call_board_user_set.cgi endpoint of the Web UI component. Attackers can inject malicious script content through the title, note, URL, or content parameters. The payload persists in the device and executes in the browser of any authenticated user who views the affected page. The vendor was contacted but did not respond to the disclosure. A public exploit reference exists via VulDB and a GitHub advisory [CWE-79].
Critical Impact
Authenticated attackers can store JavaScript payloads in the router Web UI that execute in administrator browsers, enabling session abuse and administrative action hijacking.
Affected Products
- Netcore NR268 router
- Firmware version 1.7.121109
- Web UI component (/router/l7_call_board_user_set.cgi)
Discovery Timeline
- 2026-10-12 - CVE-2026-108908 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-108908
Vulnerability Analysis
The vulnerability affects the call board user configuration handler exposed by the Netcore NR268 Web UI. The eval function processing /router/l7_call_board_user_set.cgi requests fails to sanitize user-supplied input before storing it. Attacker-controlled values submitted through the title, note, URL, and content fields are later rendered unescaped in the administrative interface. When a privileged user visits the affected view, the stored payload executes in the browser context of the router domain. This gives an attacker the ability to perform actions on behalf of the administrator, including modifying router configuration, exfiltrating session data, or pivoting into the internal network. The attack requires high privileges to inject the payload and user interaction to trigger it, but is reachable over the network.
Root Cause
The root cause is missing output encoding and input validation in the call board configuration handler. User-controlled parameters are stored in device state and reflected back to the Web UI without HTML entity encoding. This classifies as Improper Neutralization of Input During Web Page Generation [CWE-79].
Attack Vector
An attacker with authenticated access to the Netcore NR268 Web UI sends a crafted POST request to /router/l7_call_board_user_set.cgi containing JavaScript in one or more of the title, note, URL, or content fields. The payload is persisted in device configuration. When an administrator subsequently loads the call board page, the browser parses and executes the stored script. Technical details are published in the GitHub Stored XSS Report and the VulDB CVE-2026-108908 entry.
Detection Methods for CVE-2026-108908
Indicators of Compromise
- POST requests to /router/l7_call_board_user_set.cgi containing HTML tags, <script> fragments, event handlers such as onerror= or onload=, or javascript: URI schemes in the title, note, URL, or content parameters.
- Unexpected administrative configuration changes on the Netcore NR268 following access to the call board page.
- Outbound HTTP requests from administrator browsers to attacker-controlled hosts shortly after visiting the router Web UI.
Detection Strategies
- Inspect HTTP request bodies to the vulnerable CGI endpoint for angle brackets, encoded script tags, and common XSS payload markers.
- Compare stored call board field values against an allowlist of alphanumeric and punctuation characters; alert on markup content.
- Correlate Web UI authentication events with configuration write operations originating from the same session to identify tampering.
Monitoring Recommendations
- Enable access logging on the router management interface and forward logs to a central collection point for review.
- Monitor administrator workstations for anomalous browser-originated traffic following router Web UI access.
- Track configuration drift on NR268 devices to detect persisted script content in call board fields.
How to Mitigate CVE-2026-108908
Immediate Actions Required
- Restrict access to the Netcore NR268 Web UI to trusted management networks and remove any exposure to the public internet.
- Change administrator credentials and disable unused Web UI accounts to limit who can reach the vulnerable endpoint.
- Audit the call board configuration for existing stored payloads and clear any fields containing markup or scripting content.
Patch Information
No vendor patch is available. The VulDB submission notes the vendor was contacted early and did not respond. Operators should assume the vulnerability remains unaddressed and apply compensating controls. Monitor the VulDB Vulnerability #416703 entry for any future vendor updates.
Workarounds
- Place the router management interface behind a dedicated management VLAN accessible only through an administrative jump host.
- Use a separate browser profile or isolated browser session when administering the device to limit the impact of a stored payload.
- Disable the call board feature if it is not required in the deployment.
- Consider replacing the device with a supported model if the vendor continues to be unresponsive to security disclosures.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
