CVE-2026-76853

HIGH 8.1

Netcore NR268 1.7.121109 Security Check Bypass in parame_put_file.cgi

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

Netcore NR268 firmware version 1.7.121109 contains a security check bypass vulnerability in the parame_put_file.cgi restore archive prefix validation. Attackers can exploit the flawed prefix check in put_parame_file_cgi.c to bypass restricted restore archive handling.

CWE	CWE-353
Vendor	netcore
Product	nr268
Published	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for netcore nr268

Be the first to know when new high vulnerabilities affecting netcore nr268 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Affected Versions

Netcore / NR268

1.7.121109

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr268-restore-bypass.md vulncheck.com: https://www.vulncheck.com/advisories/netcore-nr268-1.7.121109-security-check-bypass-in-parame-put-file-cgi

Credits

Zhou Ao Yin Luxing Jiang Yuxuan Liu Xin @Nebusec