CVE-2026-76864 in NR255-V
Summary
by MITRE • 09/16/2026
NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is later processed by the affected handlers.'
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in NR255-V version 1.5.130703 represents a critical server-side injection flaw rooted in inadequate input validation and unsafe execution of user-supplied data. The core technical deficiency lies within the handling of Quality of Service rule names, which are accepted as direct inputs from network requests without sufficient sanitization or encoding before being passed to an eval function. This architectural oversight allows malicious actors to inject arbitrary script code into the system by crafting specific QoS rule name payloads that bypass existing filters. The affected components include qos_xianz_add_cgi and qos_xianz_show_cgi, as well as qos_filter_add_cgi and qos_filter_show_cgi handlers, all of which process these unsanitized inputs in a manner that facilitates code execution rather than simple data storage or display.
From an operational perspective, this flaw enables persistent cross-site scripting attacks within the administrative interface context. Because the injected script is stored alongside legitimate configuration data, it remains active until manually removed by an administrator. When any authorized user subsequently views or modifies QoS rules through the affected CGI handlers, the embedded malicious code executes in their browser session with the privileges of that authenticated user. This persistence mechanism significantly amplifies the impact compared to non-persistent injection vectors, as a single successful exploitation can compromise multiple sessions over time without requiring repeated attacks against different users simultaneously.
The security implications are severe, particularly for network infrastructure devices where administrative access controls are paramount. An attacker leveraging this vulnerability could hijack administrator sessions, steal sensitive configuration data such as firewall rules or routing tables, or even execute commands on the underlying device if further vulnerabilities exist that allow escalation from client-side script execution to server-side command injection. This aligns with Common Weakness Enumeration category CWE-79, which classifies improper neutralization of input during web page generation known as cross-site scripting. Furthermore, the use of eval() for processing dynamic content is a classic anti-pattern often associated with CWE-95, indicating direct evaluation of code from untrusted sources without proper validation or sandboxing mechanisms.
In terms of threat modeling and adversary behavior, this vulnerability maps directly to MITRE ATT&CK technique T1059, specifically the execution of scripts such as JavaScript within a web application context. The persistence aspect corresponds to techniques involving stored payloads that trigger upon specific user interactions, akin to T1189 Drive-by Client or more accurately in this administrative context, credential harvesting and session hijacking via injected client-side code. Attackers would typically probe for these CGI endpoints using automated scanners looking for reflected or stored injection points within form fields related to network configuration parameters.
Mitigation strategies must focus on immediate input validation and output encoding practices. Developers should implement strict allow-listing for QoS rule names, ensuring that only alphanumeric characters, hyphens, underscores, and periods are permitted while rejecting any special characters such as quotes, angle brackets, or semicolons that could terminate strings or inject new script tags. Additionally, the use of eval() for processing user-derived data should be eliminated entirely in favor of safer parsing methods provided by standard libraries. If dynamic evaluation is strictly necessary due to legacy constraints, it must be preceded by rigorous sanitization and context-aware encoding based on OWASP guidelines for preventing cross-site scripting. Temporary workarounds include deploying a Web Application Firewall rule that blocks requests containing script-like patterns within QoS configuration parameters until the software vendor releases an updated version with patched handlers.