CVE-2026-76858 Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddnswanlistshow.cgi caused by unsafe eval handling of DDNS data. Attackers can inject malicious script through the DDNS configuration path, leading to persistent execution when the affected page is viewed...

CVE-2026-76856 Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wanconfigsetcgi, wannumsetcgi, and lanipchangecgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration...

CVE-2026-76856 Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wanconfigsetcgi, wannumsetcgi, and lanipchangecgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration...

CVE-2026-76856

Netcore NR255-V firmware version 1.5.130703 is affected by a cross-site request forgery (CSRF) vulnerability in the wan_config_set_cgi , wan_num_set_cgi , and lan_ip_change_cgi endpoints. An unauthenticated attacker can craft forged requests that, when triggered by an authenticated administrator,...

CVE-2026-76855 Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7webauthlogdumpcgi.c, auditgetcgi.c, and moddispatchauth/plan.json. Attackers can query these audit components to obtain other users' session and browsing history data...

CVE-2026-76854 Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7webauthusershow.cgi related to captive-portal credential handling. Attackers can query this component to obtain captive-portal user credentials, compromising confidentiality of authenticated network...

CVE-2026-76855 Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7webauthlogdumpcgi.c, auditgetcgi.c, and moddispatchauth/plan.json. Attackers can query these audit components to obtain other users' session and browsing history data...

CVE-2026-76854

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the l7_web_auth_user_show.cgi component, related to captive-portal credential handling. A network-based attacker with low privileges can query this endpoint to obtain captive-portal user credentials, c...

CVE-2026-76855

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in its audit endpoints, specifically in l7_web_auth_log_dump_cgi.c , audit_get_cgi.c , and mod_dispatch_auth/plan.json . Attackers with low privileges can query these components to obtain other users' ses...

CVE-2026-76854 Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7webauthusershow.cgi related to captive-portal credential handling. Attackers can query this component to obtain captive-portal user credentials, compromising confidentiality of authenticated network...

PT-2026-93195

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntools tcpdump start set.cgi caused by an unsized sprintf call when processing form values. An attacker can submit crafted input to this cgi endpoint to overflow the stack buffer and potentially execute arbitrary code...

CVE-2026-92257: Improper Neutralization of Input During Web Page Generation

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious cod...

CVE-2026-92256: Insufficiently Protected Credentials

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpdconfigshowcgi.c, ipsecshowcgi.c, and modvpnremote/plan.json read handlers. Attackers can query l2tpdconfigshow.cgi to expose stored IPsec PSK and RSA key material...

CVE-2026-92255: Out-of-bounds Read

Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filterarpputfile.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component, potentially exposing adjacent memory...

CVE-2026-76873: Improper Neutralization of Input During Web Page Generation

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components handling hostname fields. A LAN-based attacker can inject malicious script through these hostname fields, which is later rendered by...

CVE-2026-76872: Improper Neutralization of Input During Web Page Generation

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcpaddstaticipcgi, dhcpstaticipshowcgi, ipaclsetcgi, and ipaclshowcgi. Attackers can inject persistent malicious scripts through these components to...

CVE-2026-76871: Insufficiently Protected Credentials

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in modvpnremote/plan.json, pptpdusershow.cgi, pptpclientconfigshow.cgi, and l2tpdusershow.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials...

CVE-2026-76870: Out-of-bounds Read

Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in the mtdwrite pre-flash validation routine triggered by short firmware uploads. Attackers can upload a truncated firmware image via putfilecgi.c to trigger out-of-bounds reads across main.c, checkimageuuid.c, and...

CVE-2026-76869: Stack-based Buffer Overflow

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in reboottimerset.cgi caused by improper sscanf token parsing. Attackers can exploit this flaw by submitting crafted input to the affected endpoint to corrupt stack memory...

CVE-2026-76868: NULL Pointer Dereference

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in routepolicyadd.cgi caused by a missing exitport parameter. Attackers can send requests lacking the exitport field to trigger the null pointer dereference, resulting in a denial of service...