Is CVE-2026-108907 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108907 being exploited in the wild.

How severe is CVE-2026-108907?

Critical severity, with a CVSS score of 10, published 12 October 2026.

How is CVE-2026-108907 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-108907?

Check whether you run Netcore NR268 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108907: Netcore NR268 authentication bypass in CGI execution

CVE-2026-108907 · Severity: critical · CVSS 10 · Published 2026-10-12

The Netcore NR268 router's web administration interface fails to properly authenticate HTTP requests to privileged functions when its authentication cache file is missing or corrupted. An attacker on the network can bypass login completely and execute administrative actions such as rebooting the device, resetting to factory settings, changing admin credentials, uploading firmware, or reading sensitive configuration data.

Technologies: Netcore NR268. Vendors: Netcore.

Quick answers

Is CVE-2026-108907 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108907 being exploited in the wild.
How severe is CVE-2026-108907?: Critical severity, with a CVSS score of 10, published 12 October 2026.
Which products and versions are affected?: Netcore NR268 1.7.121109.
Is there a fix for CVE-2026-108907?: No fixed version is recorded yet. Ensure the /tmp/passwd credential cache file exists and is properly formatted with name= and password= fields; monitor the switch daemon's credential cache rebuild process to prevent it from seeding default guest/guest credentials on failure. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108907 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-108907?: Check whether you run Netcore NR268 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Ensure the /tmp/passwd credential cache file exists and is properly formatted with name= and password= fields; monitor the switch daemon's credential cache rebuild process to prevent it from seeding default guest/guest credentials on failure.

Technical details

The vulnerability exists in the user_ok() function of the Boa web server component: when the credentials cache file /tmp/passwd is missing or malformed, get_password() returns -1, but user_ok() incorrectly interprets this as successful authentication and returns 1. The process_header_end() function then treats any positive user_auth() result as authorized, allowing requests with arbitrary or missing HTTP Basic credentials to reach CGI endpoints. Attack requires only network access to the management interface; no valid credentials are needed when the cache is absent.

Affected products

Netcore NR268 1.7.121109

Timeline

2026-09-14: disclosed: Vulnerability report published on GitHub
2026-10-12: advisory: CVE-2026-108907 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.