---
id: CVE-2026-108908
title: A vulnerability was identified in Netcore NR268 1.7.121109
summary: >-
  A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this
  vulnerability is the function eval of the file
  /router/l7_call_board_user_set.cgi of the component Web UI. Such manipulation
  of the argument title/note/URL/cont…
severity: low
cvss: 2.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-79
  - CWE-94
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:13.543'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108908'
references:
  - url: >-
      https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-call-board-stored-xss.md
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-108908'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/977174'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416703'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416703/cti'
    label: cna@vuldb.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.170Z'
---

## Overview

A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7_call_board_user_set.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.