CVE-2026-76852

HIGH 8.8

Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtd_write allowing forged firmware authenticity checks. Attackers can exploit put_file.cgi and check_image_uuid.c to bypass firmware signature validation and load unauthorized firmware images.

CWE	CWE-354
Vendor	netcore
Product	nr268
Published	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for netcore nr268

Be the first to know when new high vulnerabilities affecting netcore nr268 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Netcore / NR268

1.7.121109

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr268-firmware-forgery.md vulncheck.com: https://www.vulncheck.com/advisories/netcore-nr268-1.7.121109-forgeable-firmware-authenticity-check-in-mtd-write

Credits

Zhou Ao Yin Luxing Jiang Yuxuan Liu Xin @Nebusec