CVE-2026-108931 Overview
CVE-2026-108931 is a stored cross-site scripting (XSS) vulnerability in the Netcore NR268 router running firmware version 1.7.121109. The flaw resides in the eval function of the dhcp_dynamicip_show.cgi script within the DHCP Handler component. An attacker can inject malicious script content through the Hostname argument, which is later rendered unsanitized in the device's web interface. The attack can be launched remotely and the exploit has been publicly disclosed. According to the advisory, the vendor was contacted prior to disclosure but did not respond.
Critical Impact
Remote attackers can store malicious JavaScript in the router's DHCP client list, which executes in the browser of any administrator viewing the affected interface.
Affected Products
- Netcore NR268 router
- Firmware version 1.7.121109
- DHCP Handler component (dhcp_dynamicip_show.cgi)
Discovery Timeline
- 2026-10-12 - CVE CVE-2026-108931 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-108931
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw tracked under [CWE-79]. The affected endpoint dhcp_dynamicip_show.cgi is responsible for rendering the list of DHCP clients currently leased by the router. When a DHCP client requests an address, the device records the client-supplied Hostname field and later displays it on the administrative interface without proper output encoding.
Because the Hostname string is passed into an eval context during page generation, injected markup and script content execute within the administrator's browser session. The attack requires user interaction, specifically an administrator loading the DHCP client page, but no authentication is required to plant the payload. The exploit code has been published and is available to any attacker on the same broadcast domain or capable of reaching the DHCP service remotely.
Root Cause
The root cause is missing input sanitization and output encoding on the Hostname parameter processed by the DHCP Handler. The device trusts attacker-controlled DHCP option data and reflects it into HTML without neutralizing script characters.
Attack Vector
An attacker sends a crafted DHCP request containing a malicious Hostname value, for example a string embedding HTML <script> tags. The router stores the hostname in its dynamic IP lease table. When an administrator opens the DHCP client view generated by dhcp_dynamicip_show.cgi, the payload executes in their browser. Successful exploitation can facilitate session theft, forced configuration changes through the administrative UI, or pivoting into the internal network.
No verified proof-of-concept code is reproduced here. Technical details are available in the GitHub Security Report and the VulDB entry for CVE-2026-108931.
Detection Methods for CVE-2026-108931
Indicators of Compromise
- DHCP lease entries containing HTML tags, angle brackets, or JavaScript keywords in the Hostname field.
- Unexpected administrative actions originating from an admin browser session shortly after viewing the DHCP client list.
- Outbound requests from administrator workstations to unknown domains immediately after accessing the router web interface.
Detection Strategies
- Inspect DHCP server logs and lease tables for client hostnames containing characters such as <, >, ", ', or script.
- Monitor HTTP responses from the router's management interface for reflected unsanitized hostname values.
- Deploy network intrusion detection signatures matching DHCPREQUEST and DHCPDISCOVER packets carrying script-like payloads in DHCP option 12 (Host Name).
Monitoring Recommendations
- Log and alert on administrator access to dhcp_dynamicip_show.cgi combined with anomalous browser-originated requests.
- Baseline normal hostname patterns on the network and flag deviations containing special characters or excessive length.
- Track management-plane traffic to the Netcore NR268 for session anomalies that may indicate stolen cookies.
How to Mitigate CVE-2026-108931
Immediate Actions Required
- Restrict access to the router's administrative interface to trusted management VLANs only.
- Avoid viewing the DHCP client list from administrator workstations until a patch is applied.
- Isolate the Netcore NR268 from untrusted network segments where unauthorized DHCP clients can register.
- Review existing DHCP leases and purge entries containing suspicious hostname values.
Patch Information
No vendor patch is currently referenced in the advisory. The disclosure notes that the vendor did not respond to coordinated disclosure attempts. Administrators should monitor the VulDB vulnerability record for future patch availability and consider replacing the device if a fix is not published.
Workarounds
- Deploy an upstream DHCP server and disable the DHCP service on the Netcore NR268 where feasible.
- Enforce a browser content security policy or script-blocking extension on administrator workstations accessing the router UI.
- Place the router management interface behind a network access control list limiting it to a dedicated management host.
- Segment IoT and guest networks so untrusted devices cannot send DHCP traffic to the affected router.
# Configuration example: restrict management access with an upstream ACL
# Replace 192.0.2.10 with the authorized management workstation
iptables -A FORWARD -p tcp -d <router_mgmt_ip> --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_mgmt_ip> --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
