Vulnerabilities

TI-2026-84475 CVE-2026-121382 · GHSA-c894-38h9-3f4g

Integer overflow in Netcore NBR100V2 auto_ac msg_aes_dec

MEDIUM 44

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00576 Published 2026-11-03 No fix listed CWE-189

TI-2026-76168 CVE-2026-112016 · GHSA-498m-g7jx-66f7

Unauthenticated file write in Netcore NR256CN Boa web server

LOW 30

Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00335 Published 2026-10-18 No fix listed CWE-306

TI-2026-75498 CVE-2026-111712 · GHSA-5r7c-rr63-2rwm

Authentication bypass in Netcore NR256CN via prefixed CGI paths

LOW 36

Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00227 Published 2026-10-16 No fix listed CWE-288

TI-2026-75497 CVE-2026-111711 · GHSA-5769-g37j-m8jq

Pre-auth stack overflow in Netcore NR256CN Boa web server

MEDIUM 49

Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00492 Published 2026-10-16 No fix listed CWE-121

TI-2026-75496 CVE-2026-111710 · GHSA-w32x-fxxg-m4fc

NULL pointer dereference in Netcore NR256CN Boa web server

MEDIUM 43

Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization he…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00291 Published 2026-10-16 No fix listed CWE-476

TI-2026-71349 CVE-2026-108932 · GHSA-6rvj-w5mp-xvp3

Cross-site scripting in Netcore NR268 DHCP Hostname handler

MEDIUM 57

A vulnerability was determined in Netcore NR268 1.7.121109.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00263 Published 2026-10-12 No fix listed CWE-79

TI-2026-71277 CVE-2026-108931 · GHSA-8863-378g-v6qf

Cross-site scripting in Netcore NR268 DHCP handler

MEDIUM 57

A vulnerability was found in Netcore NR268 1.7.121109.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00263 Published 2026-10-12 No fix listed CWE-79

TI-2026-71276 CVE-2026-108930 · GHSA-f4hf-p864-9577

Information disclosure in Netcore NR268 DDNS handler

LOW 23

A vulnerability has been found in Netcore NR268 1.7.121109.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00277 Published 2026-10-12 No fix listed CWE-200

TI-2026-71275 CVE-2026-108929 · GHSA-q83v-h5qh-mxfc

Argument injection in Netcore NR268 DDNS configuration

MEDIUM 43

A flaw has been found in Netcore NR268 1.7.121109.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00429 Published 2026-10-12 No fix listed CWE-74

TI-2026-71206 CVE-2026-108909 · GHSA-843r-mv5h-qhw2

Cross-site request forgery in Netcore NR268 CGI endpoint

LOW 23

A security flaw has been discovered in Netcore NR268 1.7.121109.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00155 Published 2026-10-12 No fix listed CWE-352

TI-2026-71205 CVE-2026-108908 · GHSA-g6vv-rvqm-27w3

Cross-site scripting in Netcore NR268 Web UI eval function

MEDIUM 55

A vulnerability was identified in Netcore NR268 1.7.121109.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00202 Published 2026-10-12 No fix listed CWE-79

TI-2026-71052 CVE-2026-108907 · GHSA-382f-xr7m-w8hq

Improper authentication in Netcore NR268 CGI Execution

HIGH 82

A vulnerability was determined in Netcore NR268 1.7.121109.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01234 Published 2026-10-12 No fix listed CWE-287

TI-2026-71045 CVE-2026-108906 · GHSA-h5cj-ppxw-rw3v

Out-of-bounds read in Netcore NR268 filter_arp_put_file.cgi

HIGH 72

A vulnerability has been found in Netcore NR268 1.7.121109.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00426 Published 2026-10-12 No fix listed CWE-119

TI-2026-65287 CVE-2026-102241 · GHSA-jxpp-wwfc-2fm6

Netcore NAP930 Backup/Restore backup_common.sh hard-coded key

MEDIUM 56

A vulnerability was determined in Netcore NAP930 0.1.241010.141410.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.0022 Published 2026-09-29 No fix listed CWE-320

TI-2026-65286 CVE-2026-102240 · GHSA-538r-x966-m3m2

Netcore NAP930 Network Tools CGI network_tools eval os command injection

HIGH 82

A vulnerability was found in Netcore NAP930 0.1.241010.141410.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.02011 Published 2026-09-29 No fix listed CWE-77

TI-2026-65153 CVE-2026-101188 · GHSA-fpr8-h6hw-956c

Netcore POWER13 ubus routerd.passwd_set password recovery

HIGH 70

A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00435 Published 2026-09-28 No fix listed CWE-640

TI-2026-65110 CVE-2026-101077 · GHSA-3h49-wmph-rwm6

Netcore NR289-GE boa_temp process_request missing authentication

HIGH 82

A flaw has been found in Netcore NR289-GE 1.4.5102.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00711 Published 2026-09-28 No fix listed CWE-287

TI-2026-65109 CVE-2026-101076 · GHSA-5577-c572-2j8c

Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection

HIGH 82

A vulnerability was detected in Netcore NR289-GE 1.4.5102.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.02011 Published 2026-09-28 No fix listed CWE-77

TI-2026-65108 CVE-2026-101075 · GHSA-xcvp-vff4-7732

Netcore NR289-GE Location Time location_time.cgi system os command injection

HIGH 82

A security vulnerability has been detected in Netcore NR289-GE 1.4.5102.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.02028 Published 2026-09-28 No fix listed CWE-77

TI-2026-65107 CVE-2026-101074 · GHSA-89wp-g8p9-x5r7

Netcore NR289-GE Authentication boa password-check stack-based overflow

HIGH 81

A weakness has been identified in Netcore NR289-GE 1.4.5102.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00778 Published 2026-09-28 No fix listed CWE-119

TI-2026-65106 CVE-2026-101073 · GHSA-94c3-4h4v-c3cm

Netcore NR289-GE CGI Dispatcher boa improper authentication

HIGH 70

A security flaw has been discovered in Netcore NR289-GE 1.4.5102.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00383 Published 2026-09-28 No fix listed CWE-287

TI-2026-65105 CVE-2026-101072 · GHSA-9rjq-vjqr-964m

Netcore NR289-GE CGI ap_ip.cgi system os command injection

HIGH 82

A vulnerability was identified in Netcore NR289-GE 1.4.5102.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01989 Published 2026-09-28 No fix listed CWE-77

TI-2026-65049 CVE-2026-101002 · GHSA-qcrv-9mf8-54m6

Netcore NBR200V2 Tools Ping network_tools system os command injection

HIGH 76

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.0167 Published 2026-09-28 No fix listed CWE-77

TI-2026-65048 CVE-2026-101001 · GHSA-fgm2-rcgf-c7h9

Netcore NBR200V2 Web Management network_tools eval os command injection

HIGH 82

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.02635 Published 2026-09-28 No fix listed CWE-77

TI-2026-65047 CVE-2026-101000 · GHSA-cxfg-m6vc-37mp

Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization

HIGH 82

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00501 Published 2026-09-28 No fix listed CWE-862

Vulnerabilities

Filters