| Title | Netcore NR268 Router NR268-V1.7.121109.bin Argument Injection |
|---|
| Description | The DDNS setter accepts attacker-controlled provider, username, password, and hostname fields and forwards them into the DDNS backend. The worker builds updatedd / oray command lines with sprintf and no quoting, then tokenizes on spaces before execvp(). A crafted hostname such as fw.example injected-argv therefore injects extra argv entries into a root-run helper without any shell metacharacters. An authenticated POST to /router/DDNSset.cgi is enough to reshape the helper invocation inside the firmware field-length limits. |
|---|
| Source | ⚠️ https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-ddns-argument-injection.md |
|---|
| User | nebula (UID 101212) |
|---|
| Submission | 09/14/2026 10:15 (1 month ago) |
|---|
| Moderation | 10/11/2026 20:13 (27 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416753 [Netcore NR268 1.7.121109 DDNS /router/DDNSset.cgi execvp hostname argument injection] |
|---|
| Points | 20 |
|---|