Is CVE-2026-108929 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108929 being exploited in the wild.

How severe is CVE-2026-108929?

Critical severity, with a CVSS score of 9.9, published 12 October 2026.

Is there a fix for CVE-2026-108929?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108929 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-108929?

Check whether you run Netcore NR268 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108929: Netcore NR268 DDNS argument injection

CVE-2026-108929 · Severity: critical · CVSS 9.9 · Published 2026-10-12

Netcore NR268 is a home router that manages dynamic DNS (DDNS) settings to keep the router accessible even when its IP address changes. An authenticated attacker can inject extra command-line arguments into the DDNS helper process by manipulating the hostname field, potentially rearranging how the router processes DDNS credentials and configuration. This could allow an attacker to disrupt DDNS functionality or alter its behavior.

Technologies: Netcore NR268. Vendors: Netcore.

Quick answers

Is CVE-2026-108929 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108929 being exploited in the wild.
How severe is CVE-2026-108929?: Critical severity, with a CVSS score of 9.9, published 12 October 2026.
Which products and versions are affected?: Netcore NR268 1.7.121109.
Is there a fix for CVE-2026-108929?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108929 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-108929?: Check whether you run Netcore NR268 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An argument injection vulnerability exists in /router/DDNSset.cgi where the hostname parameter is copied without proper escaping and then space-tokenized before being passed to execvp(). An authenticated attacker can inject spaces into the hostname field to create additional argv tokens that reshape the underlying DDNS helper command invocation running as root. The vulnerability requires HTTP Basic authentication but allows modification of DDNS provider arguments, credentials handling, and network interface configuration.

Affected products

Netcore NR268 1.7.121109

Timeline

2026-09-14: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.