CVE-2026-76871 in NR255-V
Summary
by MITRE • 09/16/2026
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The Netcore NR255-V router running firmware version 1.5.130703 is affected by a critical sensitive information disclosure vulnerability that exposes user authentication credentials for Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Tunneling Protocol (L2TP) virtual private network services. This flaw resides within several specific CGI scripts and JSON endpoints, namely mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi. These components are designed to retrieve configuration data for administrative or diagnostic purposes but fail to implement adequate access controls or output sanitization mechanisms. Consequently, unauthenticated attackers can interact with these endpoints directly via HTTP requests without requiring valid session tokens or prior authentication credentials.
The technical nature of this vulnerability aligns closely with CWE-200, which classifies the exposure of information that could aid in further attacks as a significant security risk. By accessing these specific URLs, an attacker can retrieve plaintext usernames and passwords associated with VPN accounts configured on the device. The presence of PPTP credentials is particularly concerning given that this protocol has known cryptographic weaknesses and is often used for remote access to corporate networks or home lab environments. Similarly, L2TP configurations frequently carry sensitive network topology information alongside authentication data. The ability to extract these details allows an adversary to map out the internal network structure and identify potential entry points for lateral movement.
From a tactical perspective, this vulnerability facilitates unauthorized access through credential theft, which maps directly to MITRE ATT&CK technique T1078, specifically Valid Accounts. Once the attacker obtains valid VPN credentials, they can establish encrypted tunnels into the protected network segment behind the router. This bypasses perimeter defenses such as firewalls that rely on authentication gates rather than deep packet inspection for internal traffic validation. The operational impact is severe, potentially leading to full compromise of connected devices, interception of sensitive data in transit, and use of the compromised infrastructure for malicious activities including botnet recruitment or further phishing campaigns targeting other users within the same network segment.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The most effective solution is to apply firmware updates provided by Netcore that patch these specific CGI endpoints with proper authentication checks and input validation. If updating is not immediately feasible, administrators should disable PPTP and L2TP services if they are not strictly required, opting instead for more secure protocols like IPsec or WireGuard where available. Additionally, implementing network segmentation to isolate IoT devices from critical internal resources can limit the blast radius of a successful exploitation. Regular auditing of exposed management interfaces and ensuring that all administrative ports are restricted to trusted IP addresses will further reduce the attack surface associated with such information disclosure flaws.