---
cve: "CVE-2026-108907"
severity: "CRITICAL"
cvss: 10.0
epss: "1.2%"
vendor: "Netcore"
kev: false
exploited: false
published: "2026-10-12 17:17:13"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T13:37:17+01:00"
---

# CVE-2026-108907

> 10.0 CRITICAL · 🧪 PoC

## Beschreibung

A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulDB**
- State: PUBLISHED
- Stand: 2026-10-13 16:24:18
- CNA-CVSS: **10.0** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-287** — Improper Authentication
  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

## Angriffsmuster (CAPEC)

- [CAPEC-22 — Exploiting Trust in Client](https://capec.mitre.org/data/definitions/22.html) _(Severity: High)_
- [CAPEC-57 — Utilizing REST's Trust in the System Resource to Obtain Sensitive Data](https://capec.mitre.org/data/definitions/57.html) _(Severity: Very High)_
- [CAPEC-114 — Authentication Abuse](https://capec.mitre.org/data/definitions/114.html) _(Severity: Medium)_
- [CAPEC-115 — Authentication Bypass](https://capec.mitre.org/data/definitions/115.html) _(Severity: Medium)_
- [CAPEC-151 — Identity Spoofing](https://capec.mitre.org/data/definitions/151.html) _(Severity: Medium)_
- [CAPEC-194 — Fake the Source of Data](https://capec.mitre.org/data/definitions/194.html) _(Severity: Medium)_
- [CAPEC-593 — Session Hijacking](https://capec.mitre.org/data/definitions/593.html) _(Severity: Very High)_
- [CAPEC-633 — Token Impersonation](https://capec.mitre.org/data/definitions/633.html) _(Severity: Medium)_

## ATT&CK-Techniken

- [T1040 — Network Sniffing](https://attack.mitre.org/techniques/T1040/)
- [T1548 — Abuse Elevation Control Mechanism](https://attack.mitre.org/techniques/T1548/)
- [T1185 — Browser Session Hijacking](https://attack.mitre.org/techniques/T1185/)
- [T1550.001 — Use Alternate Authentication Material:Application Access Tok](https://attack.mitre.org/techniques/T1550/001/)
- [T1563 — Remote Service Session Hijacking](https://attack.mitre.org/techniques/T1563/)
- [T1134 — Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)

## Referenzen

- <https://vuldb.com/vuln/416702>
- <https://vuldb.com/vuln/416702/cti>
- <https://vuldb.com/cve/CVE-2026-108907>
- <https://vuldb.com/submit/977173>
- <https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-boa-auth-fail-open.md>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-108907/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_