CVE-2026-76855 in NR255-V
Summary
by MITRE • 09/16/2026
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and mod_dispatch_auth/plan.json. Attackers can query these audit components to obtain other users' session and browsing history data across sessions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Netcore NR255-V router running firmware version 1.5.130703 is affected by a critical sensitive information disclosure vulnerability located within its web-based management interface. This flaw specifically impacts the audit logging subsystem, which is designed to record user activity for administrative oversight and troubleshooting purposes. The vulnerability resides in three specific components: l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and the mod_dispatch_auth/plan.json endpoint. These modules are responsible for retrieving and displaying historical authentication logs and browsing history data from the router's internal database to authorized administrators via HTTP requests.
The technical root cause of this vulnerability is an insufficient access control mechanism within these CGI scripts and JSON endpoints. While the system correctly implements authentication checks at a high level, it fails to enforce proper authorization constraints on individual audit records during retrieval operations. Consequently, when an attacker authenticates with valid credentials for any user account, regardless of their privilege level or administrative status, the backend logic does not verify whether that specific user has permission to view logs belonging to other users. The application blindly returns all available audit entries associated with the router's activity rather than filtering them based on the requesting user's identity. This design flaw allows a low-privileged user to query these endpoints and receive comprehensive data containing session identifiers, IP addresses, timestamps, and URLs visited by high-privilege administrators or other users on the same network segment.
The operational impact of this vulnerability is severe due to the nature of the exposed data. Session tokens obtained through this disclosure can be exploited for session hijacking attacks, allowing an attacker to impersonate legitimate users without needing their passwords. Furthermore, the exposure of browsing history reveals sensitive business intelligence and personal privacy information that was never intended to leave the administrative console. In a corporate or enterprise environment where multiple administrators manage network infrastructure, this flaw effectively bypasses role-based access control expectations. An attacker with minimal initial access can escalate their influence by analyzing the patterns in admin activity, identifying security policies being changed, or targeting specific services accessed by higher-privileged accounts. This aligns directly with CWE-200, which classifies information exposure as a category of vulnerabilities where sensitive data is disclosed to unauthorized actors, and maps to MITRE ATT&CK technique T1530, Data from Local System, specifically the collection phase involving log files.
Mitigation strategies for this vulnerability require both immediate remediation and long-term architectural improvements. The primary solution is to apply the vendor-provided firmware update that patches these specific CGI scripts and JSON handlers to enforce strict row-level security checks. Until an official patch is available, network administrators should restrict access to the router's management interface using firewall rules or VLAN segmentation to limit exposure to trusted IP addresses only. Additionally, implementing a Web Application Firewall with rule sets designed to detect anomalous patterns in audit log queries can provide a layer of defense against exploitation attempts. From a development perspective, future iterations must implement principle of least privilege by ensuring that every data retrieval operation validates the requester's permissions against the specific resource being accessed, rather than relying solely on general session authentication.