CVE-2026-76860 in NR255-V
Summary
by MITRE • 09/16/2026
Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in wake_up_set.cgi caused by unbounded tokenization of MAC and ID input. Attackers can supply crafted MAC and ID values to the affected endpoint to overflow the stack buffer and corrupt program memory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Netcore NR255-V version 1.5.130703 represents a critical security flaw rooted in improper input validation within the device's web management interface. Specifically, the issue resides in the wake_up_set.cgi script, which is responsible for handling network configuration parameters such as MAC addresses and unique identifiers. The core technical deficiency involves unbounded tokenization of user-supplied data where the application fails to enforce strict length limits on incoming strings before processing them. This lack of boundary checking allows an attacker to inject input payloads that exceed the allocated memory space, leading directly to a stack-based buffer overflow condition.
From a technical perspective, this flaw exploits the fundamental principle of memory management in C-based embedded systems where local variables are stored on the call stack. When the wake_up_set.cgi script processes the crafted MAC and ID values without verifying their size against the predefined buffer capacity, it writes data beyond the allocated boundaries. This overwrites adjacent memory locations that may contain critical control flow information such as return addresses or saved frame pointers. By carefully crafting these inputs, an attacker can manipulate the program counter to redirect execution flow toward malicious shellcode injected within the overflowed buffer, thereby achieving arbitrary code execution on the target device with the privileges of the compromised service process.
The operational impact of this vulnerability is severe, potentially resulting in complete compromise of the network router's integrity and confidentiality. Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on the embedded Linux system hosting the CGI script. This can lead to the installation of persistent backdoors, modification of firmware settings, or use of the compromised device as a pivot point for further attacks within the local network segment. Given that routers often serve as gateways between internal networks and the internet, compromising this component exposes all connected devices to potential surveillance, data theft, or inclusion in botnets such as Mirai variants which target IoT infrastructure.
This vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input Classic buffer overflow and is commonly associated with CWE-78 Improper Neutralization of Special Elements used in an OS Command if the executed code leads to command injection scenarios. In terms of offensive security frameworks, this exploitation technique maps to MITRE ATT&CK Tactic TA0002 Execution through techniques such as T1059 Command and Scripting Interpreter or potentially T1068 Exploitation for Privilege Escalation depending on the specific payload delivered. The attack vector is classified under Remote Code Execution via Network Access, highlighting the critical need for immediate remediation in deployed environments.
Mitigation strategies should prioritize applying vendor-provided firmware updates that address this buffer overflow by implementing strict input length validation and using safe string handling functions such as strncpy or snprintf instead of unsafe alternatives like strcpy. In cases where patching is not immediately feasible, network-level controls can be employed to restrict access to the management interface from untrusted networks. Additionally, enabling authentication mechanisms for all CGI endpoints and disabling unnecessary services reduces the attack surface significantly. Security monitoring should also focus on detecting anomalous HTTP requests with unusually long parameter values directed at wake_up_set.cgi as an indicator of potential exploitation attempts.