CVE-2026-76858 in NR255-V
Summary
by MITRE • 09/16/2026
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns_wan_list_show.cgi caused by unsafe eval() handling of DDNS data. Attackers can inject malicious script through the DDNS configuration path, leading to persistent execution when the affected page is viewed.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The Netcore NR255-V router running firmware version 1.5.130703 contains a critical stored cross-site scripting vulnerability located within the ddns_wan_list_show.cgi component. This flaw stems from an insecure implementation of JavaScript evaluation logic, specifically through the unsafe use of the eval() function when processing Dynamic DNS configuration data. Unlike reflected XSS attacks where malicious payloads are delivered via URL parameters and executed immediately upon request, this stored variant allows attackers to persistently inject executable script code into the application's backend storage or configuration files. The vulnerability is triggered during the rendering phase of the DDNS management interface, meaning that any user who accesses the affected page will have their browser execute the injected malicious scripts without further interaction from the attacker beyond the initial injection step.
From a technical perspective, the root cause lies in the failure to properly sanitize or encode input data before it is passed to dynamic code execution functions. When an administrator configures DDNS settings on the router's web interface, specific fields are intended for alphanumeric domain names and IP addresses. However, due to insufficient validation mechanisms, these inputs can contain arbitrary JavaScript payloads. The backend script then stores this untrusted data in a manner that preserves its executable nature rather than treating it as plain text. When the ddns_wan_list_show.cgi page is subsequently loaded by an administrator or any authenticated user viewing their network configuration, the browser parses the stored content and executes the embedded scripts within the context of the router's administrative domain. This bypasses same-origin policy protections because the malicious code originates from a trusted source—the legitimate web application itself—granting it full access to cookies, session tokens, local storage, and other sensitive data associated with that domain.
The operational impact of this vulnerability is severe due to its stored nature and the high privilege level typically required for DDNS configuration. An attacker who gains write access through social engineering, physical access, or a separate authentication bypass can plant persistent malicious scripts in the router's settings. Once activated, these scripts can perform session hijacking by stealing administrative cookies, allowing the attacker to impersonate legitimate users without needing their credentials. Furthermore, the script can facilitate drive-by downloads if combined with other vulnerabilities, redirect traffic through proxy servers for man-in-the-middle attacks, or exfiltrate sensitive network topology information and connected device details. Because the payload is stored on the server-side configuration rather than in a transient URL parameter, it affects every user who views the page until the malicious data is manually removed from the system, creating a long-term persistence mechanism that complicates incident response efforts.
This vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under the sub-category of Stored XSS where input validation fails before database or file storage operations. In terms of offensive security frameworks, this exploitation path maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter via JavaScript execution within a browser context, and potentially T1213 Data from Information Repositories if the script is designed to scrape configuration data for exfiltration. The lack of output encoding when rendering dynamic content into HTML or JavaScript contexts represents a fundamental deviation from secure coding standards such as OWASP Top 10 A7 Cross-Site Scripting guidelines which mandate strict input validation and context-aware output encoding.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary fix involves replacing the unsafe eval() function with safer alternatives for parsing or displaying data, ensuring that all dynamic content is properly HTML-encoded before being inserted into the DOM structure of the web interface. Input validation should be implemented at multiple layers to reject any characters outside the expected alphanumeric set plus standard domain name punctuation like hyphens and periods. Additionally, implementing Content Security Policy headers can restrict script execution sources, although this may interfere with legitimate router functionality if not carefully configured. Users are advised to update their firmware immediately upon release of a patched version from Netcore that addresses this specific CGI endpoint's handling logic. Until patches are available, restricting administrative access to trusted networks and monitoring for unusual outbound traffic patterns associated with the device can help mitigate potential exploitation risks.