| शीर्षक | Netcore NR268 Router NR268-V1.7.121109.bin Information Disclosure |
|---|
| विवरण | ddns_wan_list_show.cgi fetches configured DDNS records and appends both user_idN and passwordN directly into the JSON response. The web UI then writes those values back into the DDNS form, so any authenticated web client can recover provider credentials instead of a masked placeholder. An ordinary POST with noneed=noneed is sufficient: the handler treats stored DDNS secrets as readable configuration rather than write-only values, exposing reusable provider usernames and passwords to anyone with a management session. |
|---|
| स्रोत | ⚠️ https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-ddns-secret-disclosure.md |
|---|
| उपयोगकर्ता | nebula (UID 101212) |
|---|
| सबमिशन | 14/09/2026 10:16 AM (28 दिन पहले) |
|---|
| संयम | 11/10/2026 08:13 PM (27 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 416754 [Netcore NR268 1.7.121109 DDNS ddns_wan_list_show.cgi ddns_wan_list_show user_idN/passwordN सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|