Netcore NR255-V vulnerabilities

Vulnerability in Netcore NR255-V version 1.5.130703 involves an out-of-bounds read in the mtd_write pre-flash validation routine triggered by short firmware uploads. Attackers can upload a truncated firmware image via put_file_cgi.c to trigger out-of-bounds reads across main.c, check_image_uuid.c, and oemMD5Update.c.

Vulnerability in Netcore NR255-V version 1.5.130703 is a stack-based buffer overflow in reboot_timer_set.cgi caused by improper sscanf token parsing. Attackers can exploit this flaw by submitting crafted input to the affected endpoint to corrupt stack memory.

Vulnerability in Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSset_cgi.c and related ddns_Proc.c components, enabling OS command argument injection. Attackers can exploit the unsanitized parameters to inject additional command arguments executed with root privileges.

Vulnerability in Netcore NR255-V version 1.5.130703 is an OS command argument injection vulnerability in the Nettools tcpdump launch paths, including ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, exe_default, and ntools_proc components. Attackers can inject crafted arguments into these tcpdump launch routines to manipulate executed system commands on the device.

Vulnerability in Netcore NR255-V version 1.5.130703 is a stack-based buffer overflow in ntools_tcpdump_start_set.cgi caused by an unsized sprintf call when processing form values. An attacker can submit crafted input to this CGI endpoint to overflow the stack buffer and potentially execute arbitrary code.

Vulnerability in Netcore NR255-V version 1.5.130703 is a stack-based buffer overflow in wake_up_set.cgi caused by unbounded tokenization of MAC and ID input. Attackers can supply crafted MAC and ID values to the affected endpoint to overflow the stack buffer and corrupt program memory.

Vulnerability in Netcore NR255-V firmware version 1.5.130703 is a cross-site request forgery vulnerability affecting the wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration settings without consent.