CVE-2026-76863 in NR255-V
Summary
by MITRE • 09/16/2026
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the mod_qos_bandwidth plan.json handling within filter_conns_dump_cgi.c and IGD_CgiCall.c. Authenticated users with broad roles can access these QoS read routes to obtain live network telemetry beyond their intended privilege level.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The Netcore NR255-V router, specifically version 1.5.130703, is susceptible to a critical sensitive information disclosure vulnerability rooted in the improper handling of Quality of Service (QoS) bandwidth configuration files. This flaw resides within the CGI scripts filter_conns_dump_cgi.c and IGD_CgiCall.c, which are responsible for processing requests related to network connection monitoring and QoS policy management. The core technical deficiency involves an insufficient access control mechanism that fails to enforce strict role-based restrictions on read operations targeting the mod_qos_bandwidth plan.json file. While the system is designed to restrict certain administrative functions based on user privilege levels, it erroneously permits authenticated users with broad or elevated roles to bypass these intended limitations when accessing QoS-related endpoints.
This vulnerability allows an attacker who has obtained valid authentication credentials for a high-privilege account to exploit the misconfigured read routes. By sending specific HTTP requests to the affected CGI handlers, the attacker can retrieve live network telemetry data that is not meant to be accessible at their current privilege level or potentially by any user if the flaw extends beyond role-based boundaries as described in some interpretations of broad roles enabling unintended access. The retrieved information typically includes detailed statistics about active network connections, bandwidth usage per client device, IP addresses involved in traffic flows, and other operational metrics that provide a comprehensive view of the local network's activity. This exposure goes far beyond what is necessary for standard QoS management and reveals sensitive infrastructure details that can be leveraged for further malicious activities.
The operational impact of this vulnerability is significant as it compromises the confidentiality of network operations within the affected device environment. An adversary with access to this live telemetry data can perform detailed traffic analysis, identifying active users, their associated IP addresses, and potentially inferring usage patterns or sensitive communications based on connection metadata. This level of visibility facilitates reconnaissance efforts that are critical for planning more targeted attacks against devices connected to the network. Furthermore, knowledge of bandwidth allocation policies could allow an attacker to identify high-value targets by observing which devices consume significant resources or maintain persistent connections, thereby aiding in prioritization during a potential intrusion campaign. The exposure also undermines trust in the device's security model, as it demonstrates that authentication alone is insufficient without proper authorization checks on specific API endpoints.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure and CWE-862: Missing Authorization, indicating a failure to enforce appropriate access controls after successful authentication. In the context of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to T1046: Network Service Discovery, where an attacker uses discovered information about network services and their configurations to map out the attack surface. Additionally, if the telemetry reveals specific application traffic patterns, it may relate to T1071: Application Layer Protocol, as understanding protocol usage aids in crafting more effective social engineering or exploitation attempts against internal systems. The vulnerability essentially turns a management interface into an intelligence-gathering tool for unauthorized parties who have compromised user credentials.
Mitigation strategies must focus on immediate remediation of the access control logic within the affected CGI scripts and firmware updates that address this flaw. Administrators should ensure they are running the latest available firmware version provided by Netcore, which likely includes patches to restrict read access to plan.json strictly according to defined administrative roles rather than allowing broad role-based bypasses. In environments where immediate patching is not feasible, network segmentation can help limit exposure by isolating management interfaces from general user networks and restricting direct internet-facing access to the router's administration ports. Additionally, enforcing strong password policies and multi-factor authentication for all administrative accounts reduces the likelihood of credential compromise that precedes exploitation of this vulnerability. Regular auditing of CGI endpoint permissions is recommended to ensure no similar misconfigurations exist in other management functions, maintaining a robust security posture against information disclosure attacks.