CVE-2026-76864
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Netcore NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in the qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is later processed by the affected handlers.
Risk Assessment
Enables persistent execution of arbitrary JavaScript in the router's administrative interface, potentially leading to admin session hijacking or unauthorized configuration changes.
Recommendation
Update the Netcore NR255-V firmware to a version that fixes the vulnerability, or restrict access to the management interface to trusted networks only.
Other vulnerabilities in Netcore NR255-V
See all- CVE-2026-92257Medium
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content.
- CVE-2026-92256Medium
Netcore NR255-V version 1.5.130703 exposes sensitive information through l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json read handlers. An attacker can query l2tpd_config_show.cgi to retrieve stored IPsec PSK and RSA key material.
- CVE-2026-92255Medium
Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. An attacker can trigger an unterminated buffer over-read, potentially exposing adjacent memory contents.
- CVE-2026-76873Medium
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components handling hostname fields. A LAN-based attacker can inject malicious script through these hostname fields, which is later rendered by network_config.js and network_security.js in the web management interface.
- CVE-2026-76872Medium
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Attackers can inject persistent malicious scripts through these components to compromise the web management interface for other users.
- CVE-2026-76871Medium
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials.
- CVE-2026-76870High
Vulnerability in Netcore NR255-V version 1.5.130703 involves an out-of-bounds read in the mtd_write pre-flash validation routine triggered by short firmware uploads. Attackers can upload a truncated firmware image via put_file_cgi.c to trigger out-of-bounds reads across main.c, check_image_uuid.c, and oemMD5Update.c.
- CVE-2026-76869High
Vulnerability in Netcore NR255-V version 1.5.130703 is a stack-based buffer overflow in reboot_timer_set.cgi caused by improper sscanf token parsing. Attackers can exploit this flaw by submitting crafted input to the affected endpoint to corrupt stack memory.
- CVE-2026-76868Medium
Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in route_policy_add.cgi caused by a missing exit_port parameter. Attackers can send requests lacking the exit_port field to trigger the null pointer dereference, resulting in a denial of service.
- CVE-2026-76867Medium
Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, and route_policy_parame_show_cgi. Attackers can inject persistent script payloads through these pages, which are then executed in the context of users viewing the affected pages.
Original NVD description (English source)
NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is later processed by the affected handlers.'
Vulnerability data from NVD (NIST) · CISA KEV · EPSS