CVE-2026-76857 in NR255-V
Summary
by MITRE • 09/16/2026
Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddns_wan_list_show.cgi endpoint and related DDNSset_cgi, IGD_GetCgiHandler, and IGD_CgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing sensitive account information.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The Netcore NR255-V router running firmware version 1.5.130703 is affected by a critical sensitive information disclosure vulnerability located within its Dynamic DNS configuration interface. This flaw specifically impacts the ddns_wan_list_show.cgi endpoint and associated backend components including DDNSset_cgi, IGD_GetCgiHandler, and IGD_CgiCall. The vulnerability arises from improper handling of user input or insufficient sanitization during the retrieval process for WAN-based Dynamic DNS settings. When an authenticated attacker interacts with this specific CGI handler, the system fails to mask sensitive credentials before returning them in the response payload. This results in the direct exposure of plaintext Domain Name System (DDNS) usernames and passwords that are stored within the router's configuration database.
From a technical perspective, this issue represents a classic case of insecure data storage or improper output encoding where confidential authentication material is transmitted without encryption or obfuscation. The vulnerability allows an adversary who has gained access to the administrative interface, either through valid credentials obtained via phishing, brute force attacks on weak default passwords, or other lateral movement techniques within a compromised network segment, to extract these plaintext secrets. Because DDNS services are often used by remote users and IoT devices to maintain connectivity despite changing IP addresses, compromising these credentials can lead to significant downstream consequences including unauthorized access to internal networks, redirection of traffic for man-in-the-middle attacks, or complete control over the associated domain names which may point to critical infrastructure.
The operational impact of this vulnerability extends beyond simple credential theft. An attacker possessing plaintext DDNS credentials can hijack the dynamic DNS records managed by the router. This capability enables the attacker to redirect legitimate user traffic intended for specific services hosted on the local network or connected devices to malicious servers under their control. Such redirection facilitates phishing campaigns, data exfiltration, and further exploitation of internal assets that rely on external access via these DDNS domains. Furthermore, if users reuse credentials across multiple platforms, this disclosure could lead to broader account compromise beyond just the router's administrative interface or the specific DDNS provider service.
This vulnerability aligns with CWE-200 Information Exposure which covers situations where sensitive information is disclosed due to improper handling of data during processing and transmission. It also relates closely to CWE-798 Use of Hard-coded Credentials if the exposure reveals default or factory-set credentials, although in this context it primarily involves user-configured secrets exposed via API endpoints. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw supports techniques under T1003 Credential Dumping and potentially T1552 Unsecured Credentials where attackers seek to find sensitive data like passwords or keys stored on local systems or in network configurations for subsequent lateral movement or privilege escalation.
Mitigation strategies should prioritize immediate firmware updates provided by Netcore if available, as vendors typically release patches addressing such information disclosure flaws through improved input validation and output encoding practices. In the absence of an official patch, administrators must enforce strict access controls to ensure that only authorized personnel can reach administrative CGI endpoints. This includes changing default administrator passwords to strong complex strings, disabling remote management features unless absolutely necessary, and implementing network segmentation to limit exposure of the router's management interface to trusted internal subnets only. Additionally enabling HTTPS for all administrative communications ensures that even if credentials are transmitted, they remain encrypted in transit preventing passive eavesdropping attacks from capturing these sensitive details during routine configuration changes or status checks.