CVE-2026-76854 in NR255-V
Summary
by MITRE • 09/16/2026
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cgi related to captive-portal credential handling. Attackers can query this component to obtain captive-portal user credentials, compromising confidentiality of authenticated network access.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Netcore NR255-V router running firmware version 1.5.130703 is affected by a critical sensitive information disclosure vulnerability located within the l7_web_auth_user_show.cgi component. This specific CGI script is responsible for handling authentication logic related to the device's captive portal feature, which typically forces users on public or restricted networks to authenticate before gaining full internet access. The flaw stems from improper credential management and insufficient input validation during the retrieval of user session data. When an attacker interacts with this endpoint, the system fails to properly sanitize or restrict the output returned by the server, leading to the exposure of sensitive authentication material that should remain confidential.
From a technical perspective, the vulnerability allows remote attackers to query the l7_web_auth_user_show.cgi interface without requiring valid administrative privileges in many configurations, or it may exploit weak access controls associated with the captive portal subsystem. By sending specific HTTP requests to this endpoint, an attacker can extract stored credentials such as usernames and passwords for users who have previously authenticated through the captive portal. This behavior indicates a failure in implementing secure coding practices regarding sensitive data handling, specifically failing to adhere to principles of least privilege and proper output encoding. The exposure occurs because the script returns raw user database entries or session tokens directly to the requester without adequate verification that the requestor is authorized to view such information.
The operational impact of this vulnerability is severe as it compromises the confidentiality of authenticated network access for all users connected via the captive portal mechanism. Attackers who successfully exploit this flaw can harvest valid credentials, which may be reused in credential stuffing attacks against other services if users employ password reuse habits. Furthermore, possession of these credentials allows unauthorized entities to impersonate legitimate users, bypassing any intended restrictions or monitoring controls imposed by the network administrator. This undermines the integrity and security posture of the local area network protected by the router, potentially leading to further lateral movement within the internal network infrastructure once an attacker gains a foothold using stolen credentials.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-200, which defines exposure of sensitive information to an unauthorized actor, and specifically relates to CWE-522 regarding insufficiently protected credentials in transit or storage depending on the exact mechanism of retrieval. In terms of adversary tactics, this exploitation vector corresponds to MITRE ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate user accounts to maintain access and evade detection mechanisms designed for unknown threats. The ability to harvest these credentials facilitates subsequent phases such as credential dumping or lateral movement within the target environment.
To mitigate this risk, network administrators should immediately update the Netcore NR255-V firmware to a patched version that addresses the l7_web_auth_user_show.cgi endpoint logic and enforces strict access controls on captive portal data retrieval functions. If an immediate patch is unavailable, it is advisable to disable the captive portal feature entirely if not strictly required for business operations, thereby removing the attack surface associated with this component. Additionally, implementing network segmentation can limit the blast radius of any potential compromise by isolating guest or untrusted networks from critical internal resources. Regular security audits and penetration testing should be conducted to identify similar misconfigurations in web interfaces that handle sensitive user data, ensuring adherence to industry best practices for secure authentication system design.