CVE-2026-76867 in NR255-V
Summary
by MITRE • 09/16/2026
Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, and route_policy_parame_show_cgi. Attackers can inject persistent script payloads through these route and NAT configuration pages, which are then executed in the context of users viewing the affected pages.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Netcore NR255-V firmware version 1.5.130703 represents a critical security flaw within the device's web-based management interface, specifically affecting the Common Gateway Interface components responsible for routing and Network Address Translation configuration. This stored cross-site scripting issue resides in several specific CGI scripts including routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, and route_policy_parame_show_cgi. These components are integral to the administrative functionality of the router, allowing users to define static routes, manage NAT rules, and configure policy-based routing parameters. The presence of this vulnerability in these specific endpoints indicates a systemic failure in input validation across the configuration management subsystem rather than an isolated incident in a single module.
From a technical perspective, the core flaw involves insufficient sanitization or encoding of user-supplied data before it is processed by the backend CGI scripts and subsequently rendered back to the client browser without proper escaping. When an attacker submits malicious script payloads through these routing and NAT configuration pages, the input is not adequately filtered for executable code characters such as angle brackets, quotes, or JavaScript event handlers. Instead of being treated as literal text data representing network parameters like IP addresses or subnet masks, the injected content is stored in the device's persistent storage or database associated with the configuration settings. This persistence mechanism ensures that the malicious payload remains on the server side even after the initial request completes, setting the stage for subsequent exploitation events triggered by different users accessing the same administrative interface.
The operational impact of this vulnerability is severe due to its nature as a stored cross-site scripting attack vector classified under CWE-79 in the Common Weakness Enumeration standard. Unlike reflected XSS where the payload must be delivered via a crafted link, stored XSS allows an attacker to plant persistent malicious code that executes automatically whenever any authorized user views the affected configuration pages. This means that once the initial injection is successful, every subsequent administrator or network operator who logs into the router and navigates to routing or NAT settings will have their browser execute the injected script in the context of the administrative session. The execution occurs within the same security domain as the management interface, granting the malicious code full access to all cookies, session tokens, local storage data, and potentially sensitive configuration details displayed on those pages.
This vulnerability aligns with several tactics defined in the MITRE ATT&CK framework for enterprise environments. It directly supports techniques related to Client-Side Injection such as XSS (T1059) and can facilitate Credential Access through Steal Web Session Cookie (T1539). By stealing session cookies, an attacker can hijack active administrative sessions without needing valid credentials, effectively bypassing authentication mechanisms. Furthermore, the ability to execute arbitrary JavaScript allows for actions like Keylogging (T1056), Phishing via UI Redressing (T1204), and potentially exfiltrating sensitive network topology information or configuration backups stored in local storage. The persistence of the payload ensures that even if credentials are rotated, previously established sessions may remain compromised until the malicious script is removed from the device's configuration database.
Mitigation strategies for this vulnerability must address both immediate remediation and long-term architectural improvements. The primary solution involves applying a firmware update provided by Netcore that patches these specific CGI components with robust input validation and output encoding mechanisms. Developers should implement strict allow-listing for all fields in routing and NAT configurations, ensuring that only expected data types such as numeric values or valid IP address formats are accepted. Additionally, implementing Content Security Policy headers can help mitigate the impact of any remaining XSS vectors by restricting the sources from which scripts can be loaded. For organizations unable to immediately update firmware, network segmentation should be employed to restrict access to the management interface solely to trusted administrative subnets, reducing the attack surface available to potential adversaries attempting to exploit this flaw through social engineering or compromised internal hosts.