CVE-2026-108932 Overview
CVE-2026-108932 is a stored cross-site scripting (XSS) vulnerability in the Netcore NR268 router running firmware version 1.7.121109. The flaw resides in the eval function of filter_hosts_dump.cgi within the DHCP Hostname Handler component. An attacker who controls a client's DHCP Hostname field can inject script content that executes when an administrator views the host list in the router's web interface. The vulnerability is remotely exploitable, and the exploit has been publicly disclosed. The vendor was contacted prior to disclosure but did not respond.
Critical Impact
An unauthenticated attacker on the LAN can store malicious JavaScript in the router UI through a crafted DHCP hostname, enabling session theft, configuration changes, or redirection when an administrator loads the affected page.
Affected Products
- Netcore NR268 router
- Firmware version 1.7.121109
- filter_hosts_dump.cgi component (DHCP Hostname Handler)
Discovery Timeline
- 2026-10-12 - CVE-2026-108932 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-108932
Vulnerability Analysis
The vulnerability is a stored cross-site scripting issue [CWE-79] in the Netcore NR268's web management interface. The filter_hosts_dump.cgi endpoint renders DHCP client data back to administrators without encoding HTML-significant characters. Because the Hostname value originates from a DHCP client, any device on the LAN can supply attacker-controlled markup. When the administrator opens the host listing page, the stored payload executes in the browser session with the privileges of the authenticated administrator. Scripted actions can then alter router configuration, exfiltrate session tokens, or pivot to connected hosts.
Root Cause
The root cause is missing output encoding and input sanitization on the Hostname argument processed by the eval function in filter_hosts_dump.cgi. The handler accepts the DHCP-supplied hostname verbatim and emits it into the HTML response, allowing <script> tags and event-handler attributes to be rendered as active content.
Attack Vector
Exploitation requires network reachability to the router's DHCP service and user interaction from an administrator viewing the DHCP client page. An attacker connects a device to the LAN (or compromises an existing device), configures its DHCP hostname to a JavaScript payload, and waits for the administrator to open the host list. No authentication is required to seed the payload. Detailed proof-of-concept steps are available in the GitHub Report on XSS Vulnerability and the VulDB CVE-2026-108932 Record.
No verified exploit code is reproduced here. Refer to the published advisory for payload structure and request details.
Detection Methods for CVE-2026-108932
Indicators of Compromise
- DHCP lease entries containing HTML or JavaScript characters such as <, >, script, or onerror in the Hostname field.
- Unexpected outbound requests from an administrator's browser to unknown hosts immediately after loading the router management UI.
- New or modified router configuration entries that administrators did not initiate.
Detection Strategies
- Inspect DHCP server logs and router lease tables for client hostnames that contain non-standard characters or markup.
- Monitor administrator browser sessions for script execution originating from the router's management domain or IP.
- Correlate router configuration changes with recent administrator logins and page views of filter_hosts_dump.cgi.
Monitoring Recommendations
- Alert on DHCP hostname values that exceed normal length or contain reserved HTML characters.
- Capture and review HTTP responses from the router management interface for reflected or stored script content.
- Track endpoints that connect to the LAN with hostnames deviating from established naming conventions.
How to Mitigate CVE-2026-108932
Immediate Actions Required
- Restrict access to the router's web management interface to a dedicated management VLAN or trusted hosts only.
- Avoid opening the DHCP client listing page in the administrator browser until a patched firmware is available.
- Segment untrusted or guest devices onto a separate network with an isolated DHCP scope.
Patch Information
No vendor patch has been published. Netcore did not respond to the disclosure attempt documented in the VulDB Vulnerability #416756 record. Operators should monitor the vendor's support channel for firmware updates superseding 1.7.121109.
Workarounds
- Disable the router's web management interface when not actively administering the device.
- Enforce static DHCP reservations and block clients from registering arbitrary hostnames where feasible.
- Use a dedicated browser profile with scripting disabled when accessing the router UI, and clear sessions after use.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
