Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
67 vulnerabilities by Netcore
CVE-2026-92257 (GCVE-0-2026-92257)
Vulnerability from nvd – Published: 2026-09-15 21:58 – Updated: 2026-09-15 21:58
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks
Summary
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:58:05.366Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Stored Cross-site Scripting Across L7 Content Management Pages via eval() Sinks",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-l7-content-stored-xss.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-in-l7-content-management-via-eval-sinks"
}
],
"title": "Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92257",
"datePublished": "2026-09-15T21:58:05.366Z",
"dateReserved": "2026-09-15T21:09:51.279Z",
"dateUpdated": "2026-09-15T21:58:05.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92256 (GCVE-0-2026-92256)
Vulnerability from nvd – Published: 2026-09-15 21:58 – Updated: 2026-09-16 19:33
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers
Summary
NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json read handlers. Attackers can query l2tpd_config_show.cgi to expose stored IPsec PSK and RSA key material.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:32 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92256",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:32:50.628577Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:33:51.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json read handlers. Attackers can query l2tpd_config_show.cgi to expose stored IPsec PSK and RSA key material."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:58:04.659Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: IPsec PSK and RSA Key Disclosure via Read Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-ipsec-cred-disclosure.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-ipsec-psk-and-rsa-key-disclosure-via-l2tpd-config-show-cgi-read-handlers"
}
],
"title": "Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92256",
"datePublished": "2026-09-15T21:58:04.659Z",
"dateReserved": "2026-09-15T21:09:51.279Z",
"dateUpdated": "2026-09-16T19:33:51.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92255 (GCVE-0-2026-92255)
Vulnerability from nvd – Published: 2026-09-15 21:58 – Updated: 2026-09-15 21:58
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter_arp_put_file.cgi via String API Misuse
Summary
Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component, potentially exposing adjacent memory contents.
Severity
5.4 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component, potentially exposing adjacent memory contents."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:58:03.906Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Unterminated Buffer Over-read in filter_arp_put_file.cgi via String API Misuse",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-arp-import-overread.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter_arp_put_file.cgi via String API Misuse",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-out-of-bounds-read-in-filter-arp-put-file-cgi-via-string-api-misuse"
}
],
"title": "Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter_arp_put_file.cgi via String API Misuse",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92255",
"datePublished": "2026-09-15T21:58:03.906Z",
"dateReserved": "2026-09-15T21:09:51.279Z",
"dateUpdated": "2026-09-15T21:58:03.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76873 (GCVE-0-2026-76873)
Vulnerability from nvd – Published: 2026-09-15 21:58 – Updated: 2026-09-16 19:01
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields
Summary
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components handling hostname fields. A LAN-based attacker can inject malicious script through these hostname fields, which is later rendered by network_config.js and network_security.js in the web management interface.
Severity
5.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:01 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76873",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:01:42.625083Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:01:53.273Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components handling hostname fields. A LAN-based attacker can inject malicious script through these hostname fields, which is later rendered by network_config.js and network_security.js in the web management interface."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:58:03.216Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: LAN-Triggerable Stored Cross-site Scripting via DHCP and ARP Hostname Fields",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-dhcp-lan-xss.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-via-dhcp-and-arp-hostname-fields"
}
],
"title": "Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76873",
"datePublished": "2026-09-15T21:58:03.216Z",
"dateReserved": "2026-08-19T21:47:08.936Z",
"dateUpdated": "2026-09-16T19:01:53.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76872 (GCVE-0-2026-76872)
Vulnerability from nvd – Published: 2026-09-15 21:58 – Updated: 2026-09-17 16:55
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages
Summary
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Attackers can inject persistent malicious scripts through these components to compromise the web management interface for other users.'
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 16:55 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76872",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T16:55:16.233819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T16:55:25.813Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Attackers can inject persistent malicious scripts through these components to compromise the web management interface for other users.\u0027"
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:58:02.508Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Stored Cross-site Scripting Across DHCP/ACL/MAC/DNS/Option82 Management Pages",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-dhcp-acl-stored-xss.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-via-dhcp-acl-management-pages"
}
],
"title": "Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76872",
"datePublished": "2026-09-15T21:58:02.508Z",
"dateReserved": "2026-08-19T21:47:08.936Z",
"dateUpdated": "2026-09-17T16:55:25.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76871 (GCVE-0-2026-76871)
Vulnerability from nvd – Published: 2026-09-15 21:58 – Updated: 2026-09-15 21:58
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlers
Summary
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials.
Severity
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:58:01.852Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: PPTP/L2TP VPN Credential Disclosure via Read Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-pptp-l2tp-cred-disclosure.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-sensitive-information-disclosure-via-vpn-read-handlers"
}
],
"title": "Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76871",
"datePublished": "2026-09-15T21:58:01.852Z",
"dateReserved": "2026-08-19T21:47:08.936Z",
"dateUpdated": "2026-09-15T21:58:01.852Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76870 (GCVE-0-2026-76870)
Vulnerability from nvd – Published: 2026-09-15 21:58 – Updated: 2026-09-16 19:32
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Out-of-Bounds Read in mtd_write Firmware Upload Validation
Summary
Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in the mtd_write pre-flash validation routine triggered by short firmware uploads. Attackers can upload a truncated firmware image via put_file_cgi.c to trigger out-of-bounds reads across main.c, check_image_uuid.c, and oemMD5Update.c.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:32 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76870",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:32:19.664110Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:32:33.063Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in the mtd_write pre-flash validation routine triggered by short firmware uploads. Attackers can upload a truncated firmware image via put_file_cgi.c to trigger out-of-bounds reads across main.c, check_image_uuid.c, and oemMD5Update.c."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:58:01.174Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Out-of-bounds Reads in mtd_write Pre-flash Validation via Short Firmware Upload",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-firmware-upload-oob.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Out-of-Bounds Read in mtd_write Firmware Upload Validation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-out-of-bounds-read-in-mtd-write-firmware-upload-validation"
}
],
"title": "Netcore NR255-V 1.5.130703 Out-of-Bounds Read in mtd_write Firmware Upload Validation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76870",
"datePublished": "2026-09-15T21:58:01.174Z",
"dateReserved": "2026-08-19T21:47:08.936Z",
"dateUpdated": "2026-09-16T19:32:33.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76869 (GCVE-0-2026-76869)
Vulnerability from nvd – Published: 2026-09-15 21:58 – Updated: 2026-09-17 19:27
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot_timer_set.cgi
Summary
Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in reboot_timer_set.cgi caused by improper sscanf token parsing. Attackers can exploit this flaw by submitting crafted input to the affected endpoint to corrupt stack memory.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 18:57 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76869",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:57:16.870497Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:27:01.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in reboot_timer_set.cgi caused by improper sscanf token parsing. Attackers can exploit this flaw by submitting crafted input to the affected endpoint to corrupt stack memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:58:00.461Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Stack-based Buffer Overflow in reboot_timer_set.cgi via sscanf Token Parsing",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-reboot-timer-overflow.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot_timer_set.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stack-based-buffer-overflow-in-reboot-timer-set-cgi"
}
],
"title": "Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot_timer_set.cgi",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76869",
"datePublished": "2026-09-15T21:58:00.461Z",
"dateReserved": "2026-08-19T21:47:08.936Z",
"dateUpdated": "2026-09-17T19:27:01.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76868 (GCVE-0-2026-76868)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-16 19:02
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 NULL Pointer Dereference in route_policy_add.cgi via Missing exit_port
Summary
Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in route_policy_add.cgi caused by a missing exit_port parameter. Attackers can send requests lacking the exit_port field to trigger the null pointer dereference, resulting in a denial of service.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:02 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76868",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:02:14.816017Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:02:25.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in route_policy_add.cgi caused by a missing exit_port parameter. Attackers can send requests lacking the exit_port field to trigger the null pointer dereference, resulting in a denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:59.761Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: NULL Pointer Dereference via Missing exit_port in route_policy_add.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-route-policy-null-deref.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 NULL Pointer Dereference in route_policy_add.cgi via Missing exit_port",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-null-pointer-dereference-in-route-policy-add-cgi-via-missing-exit-port"
}
],
"title": "Netcore NR255-V 1.5.130703 NULL Pointer Dereference in route_policy_add.cgi via Missing exit_port",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76868",
"datePublished": "2026-09-15T21:57:59.761Z",
"dateReserved": "2026-08-19T21:47:08.936Z",
"dateUpdated": "2026-09-16T19:02:25.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76867 (GCVE-0-2026-76867)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-17 16:54
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers
Summary
Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, and route_policy_parame_show_cgi. Attackers can inject persistent script payloads through these route and NAT configuration pages, which are then executed in the context of users viewing the affected pages.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 16:54 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76867",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T16:54:40.664871Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T16:54:50.262Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, and route_policy_parame_show_cgi. Attackers can inject persistent script payloads through these route and NAT configuration pages, which are then executed in the context of users viewing the affected pages."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:59.049Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Stored Cross-site Scripting Across Route/NAT Configuration Pages via eval() and HTML Sinks",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-route-nat-stored-xss.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-in-route-nat-configuration-cgi-handlers"
}
],
"title": "Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76867",
"datePublished": "2026-09-15T21:57:59.049Z",
"dateReserved": "2026-08-19T21:47:08.936Z",
"dateUpdated": "2026-09-17T16:54:50.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76866 (GCVE-0-2026-76866)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-15 21:57
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters
Summary
Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSset_cgi.c and related ddns_Proc.c components, enabling os command argument injection. Attackers can exploit the unsanitized parameters to inject additional command arguments executed with root privileges.
Severity
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSset_cgi.c and related ddns_Proc.c components, enabling os command argument injection. Attackers can exploit the unsanitized parameters to inject additional command arguments executed with root privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:58.285Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: DDNS Management Builds Root-run Command Lines from Unquoted User Input",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-ddns-argv-injection.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-os-command-argument-injection-via-unquoted-ddns-parameters"
}
],
"title": "Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76866",
"datePublished": "2026-09-15T21:57:58.285Z",
"dateReserved": "2026-08-19T21:47:08.936Z",
"dateUpdated": "2026-09-15T21:57:58.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76865 (GCVE-0-2026-76865)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-16 19:31
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter Handlers
Summary
Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filter_conn_del_cgi.c and gre_prio_set_cgi.c due to unchecked atoi() results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of service.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:31 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:31:33.689629Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:31:50.392Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filter_conn_del_cgi.c and gre_prio_set_cgi.c due to unchecked atoi() results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:57.602Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: NULL Pointer Dereference via Unchecked atoi() in QoS Setter Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-null-deref-atoi.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-null-pointer-dereference-via-unchecked-atoi-in-qos-setter-handlers"
}
],
"title": "Netcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter Handlers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76865",
"datePublished": "2026-09-15T21:57:57.602Z",
"dateReserved": "2026-08-19T21:47:08.936Z",
"dateUpdated": "2026-09-16T19:31:50.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76864 (GCVE-0-2026-76864)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-17 19:27
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names
Summary
NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is later processed by the affected handlers.'
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:16 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76864",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:16:33.834658Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:27:10.526Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is later processed by the affected handlers.\u0027"
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:56.916Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Stored Cross-site Scripting via Unescaped QoS Rule Names in eval()-Parsed Responses",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-qos-stored-xss.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-via-unescaped-qos-rule-names"
}
],
"title": "Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76864",
"datePublished": "2026-09-15T21:57:56.916Z",
"dateReserved": "2026-08-19T21:47:08.936Z",
"dateUpdated": "2026-09-17T19:27:10.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76863 (GCVE-0-2026-76863)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-16 19:03
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes
Summary
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the mod_qos_bandwidth plan.json handling within filter_conns_dump_cgi.c and IGD_CgiCall.c. Authenticated users with broad roles can access these QoS read routes to obtain live network telemetry beyond their intended privilege level.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:03 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76863",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:03:13.763854Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:03:41.443Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the mod_qos_bandwidth plan.json handling within filter_conns_dump_cgi.c and IGD_CgiCall.c. Authenticated users with broad roles can access these QoS read routes to obtain live network telemetry beyond their intended privilege level."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:56.227Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: QoS Read Routes Expose Live Network Telemetry to Broad Authenticated Roles",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-qos-telemetry-disclosure.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-sensitive-information-disclosure-via-qos-bandwidth-plan-routes"
}
],
"title": "Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76863",
"datePublished": "2026-09-15T21:57:56.227Z",
"dateReserved": "2026-08-19T21:47:08.936Z",
"dateUpdated": "2026-09-16T19:03:41.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76862 (GCVE-0-2026-76862)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-17 16:53
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch Paths
Summary
Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launch paths, including ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, exe_default, and ntools_proc components. Attackers can inject crafted arguments into these tcpdump launch routines to manipulate executed system commands on the device.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 16:53 UTC
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76862",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T16:53:48.461183Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T16:53:59.252Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launch paths, including ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, exe_default, and ntools_proc components. Attackers can inject crafted arguments into these tcpdump launch routines to manipulate executed system commands on the device."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:55.558Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: OS Command Argument Injection in Nettools tcpdump Launch Paths",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-tcpdump-arg-injection.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch Paths",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-os-command-argument-injection-in-nettools-tcpdump-launch-paths"
}
],
"title": "Netcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch Paths",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76862",
"datePublished": "2026-09-15T21:57:55.558Z",
"dateReserved": "2026-08-19T21:47:08.935Z",
"dateUpdated": "2026-09-17T16:53:59.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76861 (GCVE-0-2026-76861)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-15 21:57
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_start_set.cgi
Summary
Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntools_tcpdump_start_set.cgi caused by an unsized sprintf call when processing form values. An attacker can submit crafted input to this cgi endpoint to overflow the stack buffer and potentially execute arbitrary code.
Severity
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntools_tcpdump_start_set.cgi caused by an unsized sprintf call when processing form values. An attacker can submit crafted input to this cgi endpoint to overflow the stack buffer and potentially execute arbitrary code."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:54.885Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Stack-based Buffer Overflow in ntools_tcpdump_start_set.cgi via Unsized sprintf",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-tcpdump-overflow.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_start_set.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stack-based-buffer-overflow-in-ntools-tcpdump-start-set-cgi"
}
],
"title": "Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_start_set.cgi",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76861",
"datePublished": "2026-09-15T21:57:54.885Z",
"dateReserved": "2026-08-19T21:47:08.935Z",
"dateUpdated": "2026-09-15T21:57:54.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76860 (GCVE-0-2026-76860)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-16 19:31
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake_up_set.cgi via MAC and ID Tokenization
Summary
Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in wake_up_set.cgi caused by unbounded tokenization of MAC and ID input. Attackers can supply crafted MAC and ID values to the affected endpoint to overflow the stack buffer and corrupt program memory.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:30 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:30:40.240306Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:31:10.277Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in wake_up_set.cgi caused by unbounded tokenization of MAC and ID input. Attackers can supply crafted MAC and ID values to the affected endpoint to overflow the stack buffer and corrupt program memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:54.190Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Stack-based Buffer Overflow in wake_up_set.cgi via Unbounded MAC and ID Tokenization",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-wake-up-set-overflow.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake_up_set.cgi via MAC and ID Tokenization",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stack-based-buffer-overflow-in-wake-up-set-cgi-via-mac-and-id-tokenization"
}
],
"title": "Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake_up_set.cgi via MAC and ID Tokenization",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76860",
"datePublished": "2026-09-15T21:57:54.190Z",
"dateReserved": "2026-08-19T21:47:08.935Z",
"dateUpdated": "2026-09-16T19:31:10.277Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76859 (GCVE-0-2026-76859)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-17 19:27
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgi
Summary
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the user_pass_show.cgi component. Low-privilege attackers can exploit this flaw via ui_config_2.xml and misc.js to disclose router credentials.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:16 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76859",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:16:31.350659Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:27:16.961Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the user_pass_show.cgi component. Low-privilege attackers can exploit this flaw via ui_config_2.xml and misc.js to disclose router credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:53.501Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Low-Privilege Router Credential Disclosure via user_pass_show.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-user-pass-disclosure.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-sensitive-information-disclosure-via-user-pass-show-cgi"
}
],
"title": "Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgi",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76859",
"datePublished": "2026-09-15T21:57:53.501Z",
"dateReserved": "2026-08-19T21:47:08.935Z",
"dateUpdated": "2026-09-17T19:27:16.961Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76858 (GCVE-0-2026-76858)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-16 19:06
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi
Summary
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns_wan_list_show.cgi caused by unsafe eval() handling of DDNS data. Attackers can inject malicious script through the DDNS configuration path, leading to persistent execution when the affected page is viewed.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:05 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76858",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:05:58.226989Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:06:08.289Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns_wan_list_show.cgi caused by unsafe eval() handling of DDNS data. Attackers can inject malicious script through the DDNS configuration path, leading to persistent execution when the affected page is viewed."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:52.802Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Stored Cross-site Scripting via DDNS eval() in ddns_wan_list_show.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-ddns-stored-xss.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-via-ddns-eval-in-ddns-wan-list-show-cgi"
}
],
"title": "Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76858",
"datePublished": "2026-09-15T21:57:52.802Z",
"dateReserved": "2026-08-19T21:47:08.935Z",
"dateUpdated": "2026-09-16T19:06:08.289Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76857 (GCVE-0-2026-76857)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-17 16:53
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgi
Summary
Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddns_wan_list_show.cgi endpoint and related DDNSset_cgi, IGD_GetCgiHandler, and IGD_CgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing sensitive account information.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 16:53 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76857",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T16:53:04.837293Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T16:53:15.499Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddns_wan_list_show.cgi endpoint and related DDNSset_cgi, IGD_GetCgiHandler, and IGD_CgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing sensitive account information."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:52.138Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: DDNS Plaintext Credential Disclosure via ddns_wan_list_show.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-ddns-cred-disclosure.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-plaintext-ddns-credential-disclosure-via-ddns-wan-list-show-cgi"
}
],
"title": "Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgi",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76857",
"datePublished": "2026-09-15T21:57:52.138Z",
"dateReserved": "2026-08-19T21:47:08.935Z",
"dateUpdated": "2026-09-17T16:53:15.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76856 (GCVE-0-2026-76856)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-15 21:57
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints
Summary
Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration settings without consent.
Severity
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration settings without consent."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:51.479Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: CSRF on WAN/LAN Reconfiguration Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-csrf-wan-reconfig.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-cross-site-request-forgery-in-wan-lan-configuration-endpoints"
}
],
"title": "Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76856",
"datePublished": "2026-09-15T21:57:51.479Z",
"dateReserved": "2026-08-19T21:47:08.935Z",
"dateUpdated": "2026-09-15T21:57:51.479Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76855 (GCVE-0-2026-76855)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-16 19:30
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints
Summary
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and mod_dispatch_auth/plan.json. Attackers can query these audit components to obtain other users' session and browsing history data across sessions.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:24 UTC
CWE
- CWE-359 - Exposure of Private Personal Information to an Unauthorized Actor
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76855",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:24:10.690852Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:30:07.791Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and mod_dispatch_auth/plan.json. Attackers can query these audit components to obtain other users\u0027 session and browsing history data across sessions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-359",
"description": "Exposure of Private Personal Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:50.785Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Cross-User Session and Browsing History Disclosure via Audit Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-audit-endpoint-disclosure.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-cross-user-session-disclosure-via-audit-endpoints"
}
],
"title": "Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76855",
"datePublished": "2026-09-15T21:57:50.785Z",
"dateReserved": "2026-08-19T21:47:08.935Z",
"dateUpdated": "2026-09-16T19:30:07.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76854 (GCVE-0-2026-76854)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-17 19:27
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi
Summary
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cgi related to captive-portal credential handling. Attackers can query this component to obtain captive-portal user credentials, compromising confidentiality of authenticated network access.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:16 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76854",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:16:28.821538Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:27:27.252Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cgi related to captive-portal credential handling. Attackers can query this component to obtain captive-portal user credentials, compromising confidentiality of authenticated network access."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:50.108Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Captive-Portal Credential Disclosure via l7_web_auth_user_show.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-captive-portal-cred-disclosure.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-sensitive-information-disclosure-via-l7-web-auth-user-show-cgi"
}
],
"title": "Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76854",
"datePublished": "2026-09-15T21:57:50.108Z",
"dateReserved": "2026-08-19T21:47:08.935Z",
"dateUpdated": "2026-09-17T19:27:27.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76853 (GCVE-0-2026-76853)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-16 19:08
VLAI
EPSS
VEX
Title
Netcore NR268 1.7.121109 Security Check Bypass in parame_put_file.cgi
Summary
Netcore NR268 firmware version 1.7.121109 contains a security check bypass vulnerability in the parame_put_file.cgi restore archive prefix validation. Attackers can exploit the flawed prefix check in put_parame_file_cgi.c to bypass restricted restore archive handling.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:07 UTC
CWE
- CWE-353 - Missing Support for Integrity Check
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr26… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76853",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:07:25.523668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:08:16.783Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR268",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.7.121109",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR268 firmware version 1.7.121109 contains a security check bypass vulnerability in the parame_put_file.cgi restore archive prefix validation. Attackers can exploit the flawed prefix check in put_parame_file_cgi.c to bypass restricted restore archive handling."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-353",
"description": "Missing Support for Integrity Check",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:49.437Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Parameter Restore Archive Bypass via Prefix Check in parame_put_file.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr268-restore-bypass.md"
},
{
"name": "VulnCheck Advisory: Netcore NR268 1.7.121109 Security Check Bypass in parame_put_file.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr268-1.7.121109-security-check-bypass-in-parame-put-file-cgi"
}
],
"title": "Netcore NR268 1.7.121109 Security Check Bypass in parame_put_file.cgi",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76853",
"datePublished": "2026-09-15T21:57:49.437Z",
"dateReserved": "2026-08-19T21:47:08.935Z",
"dateUpdated": "2026-09-16T19:08:16.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76852 (GCVE-0-2026-76852)
Vulnerability from nvd – Published: 2026-09-15 21:57 – Updated: 2026-09-17 16:52
VLAI
EPSS
VEX
Title
Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write
Summary
Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtd_write allowing forged firmware authenticity checks. Attackers can exploit put_file.cgi and check_image_uuid.c to bypass firmware signature validation and load unauthorized firmware images.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 16:52 UTC
CWE
- CWE-354 - Improper Validation of Integrity Check Value
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr26… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T16:52:01.661088Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T16:52:31.430Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR268",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.7.121109",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtd_write allowing forged firmware authenticity checks. Attackers can exploit put_file.cgi and check_image_uuid.c to bypass firmware signature validation and load unauthorized firmware images."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-354",
"description": "Improper Validation of Integrity Check Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:57:48.762Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Forgeable Firmware Authenticity Check in mtd_write",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr268-firmware-forgery.md"
},
{
"name": "VulnCheck Advisory: Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr268-1.7.121109-forgeable-firmware-authenticity-check-in-mtd-write"
}
],
"title": "Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76852",
"datePublished": "2026-09-15T21:57:48.762Z",
"dateReserved": "2026-08-19T21:47:08.935Z",
"dateUpdated": "2026-09-17T16:52:31.430Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92257 (GCVE-0-2026-92257)
Vulnerability from cvelistv5 – Published: 2026-09-15 21:58 – Updated: 2026-09-15 21:58
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks
Summary
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:58:05.366Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Stored Cross-site Scripting Across L7 Content Management Pages via eval() Sinks",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-l7-content-stored-xss.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-in-l7-content-management-via-eval-sinks"
}
],
"title": "Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92257",
"datePublished": "2026-09-15T21:58:05.366Z",
"dateReserved": "2026-09-15T21:09:51.279Z",
"dateUpdated": "2026-09-15T21:58:05.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92256 (GCVE-0-2026-92256)
Vulnerability from cvelistv5 – Published: 2026-09-15 21:58 – Updated: 2026-09-16 19:33
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers
Summary
NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json read handlers. Attackers can query l2tpd_config_show.cgi to expose stored IPsec PSK and RSA key material.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:32 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92256",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:32:50.628577Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:33:51.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json read handlers. Attackers can query l2tpd_config_show.cgi to expose stored IPsec PSK and RSA key material."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:58:04.659Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: IPsec PSK and RSA Key Disclosure via Read Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-ipsec-cred-disclosure.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-ipsec-psk-and-rsa-key-disclosure-via-l2tpd-config-show-cgi-read-handlers"
}
],
"title": "Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92256",
"datePublished": "2026-09-15T21:58:04.659Z",
"dateReserved": "2026-09-15T21:09:51.279Z",
"dateUpdated": "2026-09-16T19:33:51.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92255 (GCVE-0-2026-92255)
Vulnerability from cvelistv5 – Published: 2026-09-15 21:58 – Updated: 2026-09-15 21:58
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter_arp_put_file.cgi via String API Misuse
Summary
Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component, potentially exposing adjacent memory contents.
Severity
5.4 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component, potentially exposing adjacent memory contents."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:58:03.906Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Unterminated Buffer Over-read in filter_arp_put_file.cgi via String API Misuse",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-arp-import-overread.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter_arp_put_file.cgi via String API Misuse",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-out-of-bounds-read-in-filter-arp-put-file-cgi-via-string-api-misuse"
}
],
"title": "Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter_arp_put_file.cgi via String API Misuse",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92255",
"datePublished": "2026-09-15T21:58:03.906Z",
"dateReserved": "2026-09-15T21:09:51.279Z",
"dateUpdated": "2026-09-15T21:58:03.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76873 (GCVE-0-2026-76873)
Vulnerability from cvelistv5 – Published: 2026-09-15 21:58 – Updated: 2026-09-16 19:01
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields
Summary
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components handling hostname fields. A LAN-based attacker can inject malicious script through these hostname fields, which is later rendered by network_config.js and network_security.js in the web management interface.
Severity
5.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:01 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76873",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:01:42.625083Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:01:53.273Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components handling hostname fields. A LAN-based attacker can inject malicious script through these hostname fields, which is later rendered by network_config.js and network_security.js in the web management interface."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:58:03.216Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: LAN-Triggerable Stored Cross-site Scripting via DHCP and ARP Hostname Fields",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-dhcp-lan-xss.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-via-dhcp-and-arp-hostname-fields"
}
],
"title": "Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76873",
"datePublished": "2026-09-15T21:58:03.216Z",
"dateReserved": "2026-08-19T21:47:08.936Z",
"dateUpdated": "2026-09-16T19:01:53.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76872 (GCVE-0-2026-76872)
Vulnerability from cvelistv5 – Published: 2026-09-15 21:58 – Updated: 2026-09-17 16:55
VLAI
EPSS
VEX
Title
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages
Summary
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Attackers can inject persistent malicious scripts through these components to compromise the web management interface for other users.'
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 16:55 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/draw-ctf/netcore-router-public… | third-party-advisory |
| https://www.vulncheck.com/advisories/netcore-nr25… | third-party-advisory |
Date Public
2026-09-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76872",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T16:55:16.233819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T16:55:25.813Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NR255-V",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.5.130703",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhou Ao"
},
{
"lang": "en",
"type": "finder",
"value": "Yin Luxing"
},
{
"lang": "en",
"type": "finder",
"value": "Jiang Yuxuan"
},
{
"lang": "en",
"type": "finder",
"value": "Liu Xin"
},
{
"lang": "en",
"type": "finder",
"value": "@Nebusec"
}
],
"datePublic": "2026-09-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Attackers can inject persistent malicious scripts through these components to compromise the web management interface for other users.\u0027"
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T21:58:02.508Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Netcore router public references: Stored Cross-site Scripting Across DHCP/ACL/MAC/DNS/Option82 Management Pages",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-dhcp-acl-stored-xss.md"
},
{
"name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-via-dhcp-acl-management-pages"
}
],
"title": "Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-76872",
"datePublished": "2026-09-15T21:58:02.508Z",
"dateReserved": "2026-08-19T21:47:08.936Z",
"dateUpdated": "2026-09-17T16:55:25.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}