Netcore NR268 and Wavlink WL-WN530BE1-A Routers: CVE-2026-108929 and CVE-2026-109108 (9.9)

Two more consumer and small-business routers join the list of devices to watch: the Netcore NR268 and the Wavlink WL-WN530BE1-A. Both flaws are rated 9.9 and lead, through two closely related mechanisms, to command execution on the router.

They're part of a series we've been tracking for weeks, including the Netcore, FAST and D-Link flaws published in late September.

Reading the Vector

The vector is the same for both and worth reading closely:

• PR:L: low-privilege authenticated access to the web interface is required. On a router, that often means the admin password, sometimes still at its factory value or shared.
• S:C: the impact goes beyond the vulnerable component. The web service is the way in, but it's the router's operating system that runs the command.
• C:H/I:H/A:H: full control of the device.

The authentication requirement is weak protection on this kind of hardware: default credentials, WAN-exposed interfaces, no rate limiting on login attempts.

Netcore NR268 — CVE-2026-108929: Argument Injection in DDNS

Executing a manipulation of the argument Hostname can lead to argument injection.

The NR268's dynamic DNS (DDNS) feature passes the hostname entered in the interface to a system program without filtering it. Argument injection then lets an attacker hijack that call and change its behaviour. NVD notes the attack can be launched remotely.

Versions: NVD cites version 1.7.121109 as affected, with no fixed version. I have no information about a fixed firmware: check Netcore's website.

Wavlink WL-WN530BE1-A — CVE-2026-109108: Command Injection in VPN Upload

The exploit has been disclosed publicly and may be used.

The VPN configuration upload handler passes a request parameter to a shell without neutralising it: classic OS command injection. Two NVD notes raise the urgency: an exploit is public, and the vendor was contacted ahead of disclosure. NVD mentions no response or fix.

Versions: NVD cites version 251117 as affected, with no fixed version.

Why a Compromised Router Is a Problem

A hijacked router is an ideal observation and pivot point:

• DNS interception and redirection for all of the site's traffic
• pivot into the internal network, behind the firewall
• enrolment in a botnet of residential proxies or DDoS nodes
• persistence on a device nobody monitors

In a small business or a remote branch, this router is often the only network security device there is.

Detection

• Changed DDNS or VPN configuration with no known intervention
• Changed DNS servers in the router configuration
• Unusual outbound connections from the router's address, visible at the ISP or an upstream device
• Admin sessions from external addresses, if the router logs them
• Unexplained reboots or performance drops

Mitigation

1. Disable WAN-side administration: the web interface should only be reachable from the local network, ideally from a dedicated workstation.
2. Change the admin password to a long, unique one. Without valid credentials, PR:L remains an obstacle.
3. Disable DDNS and VPN if unused, to switch off the vulnerable feature.
4. Watch the Netcore and Wavlink websites for fixed firmware, and apply it as soon as it ships.
5. Plan replacement if no fix arrives: a router without security support doesn't belong at the edge of a business network.
6. If in doubt: factory reset the device, reinstall firmware from the official website and reconfigure by hand, without restoring a backup that may have been tampered with.

Why Continuous Monitoring of Network Devices Matters

Entry-level routers get critical CVEs every week, often with no fix announced. Without a precise inventory of models and firmware versions, there's no way to know which ones are affected.

With cveo.tech, register your routers with model and firmware version, and get alerted whenever a critical CVE hits them.