Description

A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-10-12T16:17:03.917Z",
  "pubdate": "2026-10-12T16:17:03.917Z",
  "executiveSummary": "A critical out-of-bounds read vulnerability has been identified in the Netcore NR268 router, specifically within the firmware version 1.7.121109. The flaw originates in the filter_arp_put_file_cgi function, reachable via the /router/filter_arp_put_file.cgi URI.\nThis vulnerability allows an unauthenticated remote attacker to trigger an out-of-bounds read by manipulating the 'put_file' argument. Successful exploitation may lead to the disclosure of sensitive memory contents or cause a denial-of-service condition through application crashing.\nGiven that the vendor remains unresponsive and public exploit code exists, the risk to affected devices is high. The vulnerability is exploitable remotely, requiring no prior authentication or administrative privileges, thereby significantly increasing the attack surface for exposed routers.",
  "technicalDetails": "The vulnerability is localized within the function filter_arp_put_file_cgi, which is responsible for processing file upload requests handled by /router/filter_arp_put_file.cgi. The flaw occurs due to insufficient bounds checking on user-supplied input provided through the 'put_file' parameter.\nIn the execution flow, the application fails to validate the size or structure of the data associated with the 'put_file' argument before performing memory operations. When an attacker crafts a malicious request containing a specifically formatted 'put_file' argument, the application attempts to read memory outside the intended buffer boundaries. This improper handling of input parameters results in an out-of-bounds read condition.\nThe attack flow initiates when an unauthenticated remote attacker sends an HTTP request to the vulnerable endpoint. By supplying a manipulated 'put_file' parameter, the attacker forces the firmware's internal logic to access memory regions that are not properly protected or defined for that specific process context. Because the vulnerability exists within the CGI handling layer of the web interface, it is reachable directly over the network without requiring valid credentials.\nFrom a memory safety perspective, the exploitation process involves triggering the function with inputs that bypass standard length verification. This causes the function to read beyond the allocated buffer, potentially leaking adjacent data from the process stack or heap, including system configuration, session tokens, or other sensitive memory segments. Repeated triggering of this vulnerability can also lead to memory corruption, resulting in an unstable state for the underlying web server component and potentially causing a denial-of-service (DoS) as the device stops responding to management requests.\nBecause the Netcore NR268 firmware version 1.7.121109 lacks modern memory protections and proper input sanitation, the impact is severe. An attacker can perform this exploitation remotely from any location capable of reaching the device's management interface. Since no patches have been provided by the vendor, devices remain permanently exposed to public exploit vectors that leverage this read primitive to extract data or disrupt service availability."
}