CVE-2026-76872 in NR255-V
Summary
by MITRE • 09/16/2026
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Attackers can inject persistent malicious scripts through these components to compromise the web management interface for other users.'
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Netcore NR255-V version 1.5.130703 represents a critical security flaw within the device's web-based administrative interface, specifically affecting the Dynamic Host Configuration Protocol static IP assignment and Internet Protocol Access Control List management functionalities. This stored cross-site scripting issue resides in several Common Gateway Interface scripts including dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. These components are responsible for handling user input related to network configuration parameters such as static IP addresses and firewall rules. The core technical flaw stems from the failure of these CGI endpoints to properly sanitize or validate data received from users before storing it in the backend database or rendering it back into HTML responses without adequate encoding. This lack of robust input validation allows an attacker to inject malicious JavaScript code that is persistently stored on the server, rather than being executed transiently through a manipulated URL parameter as seen in reflected XSS attacks.
From a technical perspective, this vulnerability aligns with CWE-89 which describes Improper Neutralization of Special Elements used in an SQL Command, although in this specific context it manifests more accurately under CWE-79 known as Improper Neutralization of Input During Web Page Generation commonly referred to as Cross-Site Scripting. The stored nature of the attack means that once a malicious script is injected via one of these CGI endpoints, it remains on the server until manually removed or overwritten by legitimate configuration changes. When an administrator or any other user with access privileges visits the affected pages such as viewing static IP lists or ACL configurations, their browser automatically executes the embedded malicious scripts in the context of the authenticated session. This persistence distinguishes it from temporary injection attacks and significantly increases the potential for widespread compromise among all users who interact with these management interfaces over time.
The operational impact of this vulnerability is severe due to its ability to facilitate persistent unauthorized access and data theft within the local network environment. An attacker can exploit this flaw to steal session cookies, which may allow them to hijack administrative sessions without needing valid credentials if cookie-based authentication is used without secure flags or proper expiration policies. Furthermore, the injected scripts can perform actions on behalf of the victim user, such as modifying firewall rules, changing DNS settings, or redirecting traffic through malicious proxies controlled by the attacker. This capability effectively undermines the integrity and confidentiality of network configurations managed through the device. In enterprise environments where these routers serve as gateways for multiple departments, a successful exploitation could lead to lateral movement within the internal network, data exfiltration from connected devices, or disruption of critical business operations due to altered routing policies.
This vulnerability maps directly to MITRE ATT&CK technique T1059 which covers Command and Scripting Interpreter execution via web application interfaces, specifically falling under sub-techniques related to client-side scripting abuse. The attack vector typically involves social engineering or initial access through a compromised account with write permissions for network settings, allowing the adversary to persistently maintain foothold within the administrative interface. To mitigate this risk, immediate patching of the Netcore NR255-V firmware to versions that address these CGI input validation flaws is essential. In cases where updates are not immediately available, administrators should restrict access to the web management interface by implementing strict IP whitelisting using firewall rules or placing the device behind a secure bastion host with multi-factor authentication enabled. Additionally enabling Content Security Policy headers if supported can help mitigate some effects of XSS attacks even after deployment while ensuring that all user inputs are rigorously validated against expected formats such as valid IPv4 addresses and standard ACL syntax patterns before being processed by backend systems.