CVE-2026-108906

Executive Summary

CVE-2026-108906 is an out-of-bounds read vulnerability (CWE-119) in Netcore NR268 firmware version 1.7.121109, affecting the filter_arp_put_file_cgi function reached through the /router/filter_arp_put_file.cgi endpoint. The flaw is triggered by manipulation of the put_file argument, allowing an authenticated remote attacker to read memory beyond intended buffer boundaries, resulting in high confidentiality and integrity/availability impact as scored. The exploit has been publicly disclosed, the vendor was contacted but did not respond, and no patch exists — making this a persistent risk for any internet-exposed Netcore NR268 deployments.

Technical Analysis

The vulnerability resides in the CGI handler filter_arp_put_file_cgi, part of the device's web management interface at /router/filter_arp_put_file.cgi. The NVD description states that "the manipulation of the argument put_file leads to out-of-bounds read" — meaning the handler processes a caller-supplied put_file value without adequately validating its length or contents before using it as an index, length, or buffer offset.

CWE-119 ("Improper Restriction of Operations within the Bounds of a Memory Buffer") is the assigned weakness class. In practice, an out-of-bounds read of this type occurs when a program computes a memory address or length derived from attacker-controlled input and then reads from that location without confirming it lies inside the allocated object. The consequences of a pure OOB read typically include:

• Information disclosure: adjacent heap or stack memory may contain pointers, credentials, session tokens, or configuration data that is subsequently reflected in the HTTP response.
• Denial of service: if the read crosses an unmapped page boundary, the process may crash (SIGSEGV), taking the web management service offline.
• Exploitation primitives: leaked memory addresses can defeat ASLR and serve as a foundation for follow-on memory-corruption attacks when combined with a separate write primitive.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates network reachability (AV:N), low attack complexity (AC:L), and — notably — high privileges required (PR:H). This means the attacker must already hold valid administrative credentials or an authenticated session on the device. No user interaction (UI:N) is required, the scope is unchanged (S:U), and confidentiality, integrity, and availability impacts are all rated High, which is unusually severe for a read-only bug and suggests the disclosure and/or resulting instability can cascade into broader compromise or denial of service.

Because the vendor did not respond, no official root-cause analysis, affected-build matrix, or source-level fix description is available. The specific bounds check that is missing, the exact buffer involved, and the maximum readable range are not specified in the NVD data and should not be assumed. What can be stated with confidence is the endpoint, the function name, the vulnerable argument (put_file), and the vulnerability class.

Exploitation Scenarios

No public PoC code or Nuclei template was identified in the supplied intelligence, though the NVD description confirms the exploit "has been disclosed to the public and may be used." The following attack chain is therefore described at the vulnerability-class level and is inferred from the OOB-read classification; it relies only on the endpoint, function, and argument named in the source data.

1. Reconnaissance / target identification. An adversary scans for internet-exposed Netcore NR268 management interfaces, identifying devices by their login pages, banners, or known CGI paths. Shodan-style queries such as product:"Netcore NR268" or http.html:"filter_arp" surface candidate hosts. Because the attack requires high privileges (PR:H), the adversary must first obtain valid administrative credentials — via default/weak passwords, credential stuffing, phishing, or prior compromise — or already possess an authenticated session.

2. Triggering the flaw. With an authenticated session established, the attacker sends a crafted HTTP request to /router/filter_arp_put_file.cgi, supplying a deliberately malformed value in the put_file argument. The value is constructed to push the read operation outside the bounds of the intended buffer. This is the direct trigger for the CWE-119 condition described by NVD.

3. Execution / payload method. At the vulnerability-class level, the crafted put_file value causes filter_arp_put_file_cgi to read memory beyond the allocated region. No specific payload bytes, offsets, or code patterns can be provided because the public exploit details are not included in the supplied data. The attacker iterates the argument value to probe for readable memory or to induce a crash.

4. Post-exploitation impact. Successful OOB reads may return sensitive memory contents in the HTTP response — potential leakage of credentials, session data, or internal configuration — and/or cause the CGI process to crash, degrading availability. Leaked addresses could later be leveraged to bypass ASLR in a chained exploit. Given the CVSS I:H rating, integrity impact may manifest through the ability to influence device state via the same handler or companion endpoints.

Impact Assessment

The CVSS base score of 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H frames the risk profile:

• Attack Vector (Network): exploitable remotely over the network — no physical or adjacent access required.
• Attack Complexity (Low): no specialized conditions or race windows are needed; a straightforward crafted request suffices.
• Privileges Required (High): the attacker must be authenticated with administrative rights, which substantially narrows the unauthenticated attack surface but does not eliminate risk where default or reused credentials exist.
• User Interaction (None): no victim action is needed beyond the attacker's own session.
• Scope (Unchanged): impact stays within the vulnerable component's security authority.
• Confidentiality/Integrity/Availability (High/High/High): memory disclosure (C), potential state manipulation or chained exploitation (I), and service crash/DoS potential (A).

Blast radius: Any Netcore NR268 router running firmware 1.7.121109 that exposes its web management interface — particularly to the internet — is affected. As a consumer/SMB-class routing device, compromise can expose all downstream network traffic, enable lateral movement into the local network, and facilitate traffic interception or redirection. Because the device sits at a network trust boundary, a single compromise can affect every host behind it.

Operational context: With patch confidence 0/4 (UNPATCHED), no CISA KEV listing yet, no EPSS score published, and an unresponsive vendor, defenders cannot rely on a vendor fix in the near term. Public exploit availability raises the likelihood of opportunistic scanning and weaponization.

Detection Guidance

Sigma Rule

title: Netcore NR268 filter_arp_put_file.cgi Out-of-Bounds Read Attempt
id: 3f9a1c2e-7b84-4d51-9a6e-1cve2026108906
status: experimental
description: Detects HTTP requests targeting the Netcore NR268 filter_arp_put_file.cgi endpoint with a suspiciously long or malformed put_file argument, indicative of CVE-2026-108906 OOB read attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108906
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/router/filter_arp_put_file.cgi'
  selection_arg:
    cs-uri-query|contains: 'put_file='
  selection_length:
    cs-uri-query|re: 'put_file=.{64,}'
  condition: selection_endpoint and selection_arg and selection_length
fields:
  - c-ip
  - cs-uri
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate administrative use with unusually long file paths
level: high

YARA Rule

rule CVE_2026_108906_Netcore_NR268_OOB_Read
{
    meta:
        description = "Detects Netcore NR268 CGI handler targeting filter_arp_put_file.cgi associated with CVE-2026-108906"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108906"
        date = "2026-01-01"
        severity = "high"
    strings:
        $ep1 = "/router/filter_arp_put_file.cgi" ascii nocase
        $fn1 = "filter_arp_put_file_cgi" ascii nocase
        $arg = "put_file" ascii nocase
    condition:
        any of ($ep1, $fn1) and $arg
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108906 Netcore NR268 filter_arp_put_file.cgi OOB Read Attempt"; flow:established,to_server; http.uri; content:"/router/filter_arp_put_file.cgi"; http.uri; content:"put_file="; pcre:"/put_file=[^&]{64,}/Ui"; classtype:attempted-recon; reference:cve,2026-108906; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108906; sid:2026108906; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "POST" and url.path == "/router/filter_arp_put_file.cgi" ]
  [ network where url.path == "/router/filter_arp_put_file.cgi" and
      string contains (url.query, "put_file=") and
      length(url.query) > 100 ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower = lower(uri)
| where like(uri_lower, "%/router/filter_arp_put_file.cgi%")
| rex field=uri "put_file=(?<put_file_val>[^&\s]+)"
| where len(put_file_val) > 64
| stats count values(uri) as uris by src_ip, status
| where count > 3
| sort - count
| table src_ip, count, status, uris

Wazuh OSSEC Rule

<group name="web,netcore,cve_2026_108906,">
  <rule id="2026108" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>/router/filter_arp_put_file.cgi</match>
    <regex>put_file=[^&\s]{64,}</regex>
    <description>CVE-2026-108906: Netcore NR268 filter_arp_put_file.cgi OOB read attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_108906,exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor (Netcore) was contacted about this disclosure but did not respond, and no fixed firmware version is documented. Treat all mitigation as compensating control rather than remediation.

1) Immediate mitigations

• Immediately remove the NR268 web management interface from internet exposure. Restrict /router/ (including /router/filter_arp_put_file.cgi) to trusted management VLANs via firewall/ACL rules.
• Disable remote/WAN management entirely if not operationally required.
• Enforce strong, unique administrative credentials and rotate any default or shared passwords; PR:H means valid admin access is a precondition for exploitation.
• Terminate or rotate sessions and any secrets that could have been exposed through an OOB memory leak.
• Place affected devices behind a reverse proxy or WAF that filters abnormally long put_file arguments and blocks malformed requests to the CGI path.

2) Patch / upgrade steps

• No patched firmware is available. Monitor Netcore's official support channels and NVD for a fixed build covering 1.7.121109.
• When a fix is released, back up configuration, apply the firmware update, and verify exposure of /router/filter_arp_put_file.cgi is restricted post-upgrade.
• If no fix materializes, evaluate replacement of the device with a vendor-maintained platform.

3) Long-term hardening

• Maintain an inventory of net/edge devices and subscribe to CVE feeds matching their firmware.
• Adopt a network segmentation strategy that treats routers, switches, and IoT/edge gear as high-value assets on isolated management planes.
• Continuously scan for exposed management interfaces using the Shodan dorks above (e.g., product:"Netcore NR268").
• Establish a patch SLA and vendor-viability review; unresponsive vendors are a standing supply-chain risk and warrant device replacement decisions.

References

• NVD — CVE-2026-108906: https://nvd.nist.gov/vuln/detail/CVE-2026-108906
• MITRE CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: https://cwe.mitre.org/data/definitions/119.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — CVE-2026-108906 (not yet scored): https://api.first.org/data/v1/epss?cve=CVE-2026-108906
• CISA Known Exploited Vulnerabilities Catalog (CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No named threat-actor campaigns or confirmed exploit-in-the-wild evidence were present in the supplied intelligence. The NVD description notes only that the exploit has been publicly disclosed and may be used, and that the vendor was contacted without response.