CVE-2026-76873 in NR255-V
Summary
by MITRE • 09/16/2026
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components handling hostname fields. A LAN-based attacker can inject malicious script through these hostname fields, which is later rendered by network_config.js and network_security.js in the web management interface.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Netcore NR255-V router running firmware version 1.5.130703 suffers from a critical stored cross-site scripting vulnerability located within its DHCP dynamic IP display and ARP bind list components. This flaw specifically affects how hostname fields are processed, allowing an attacker to inject malicious JavaScript code that persists on the device rather than being executed transiently in a single request. The vulnerability arises because these specific input fields do not adequately sanitize or encode user-supplied data before it is stored in the system's configuration database and subsequently rendered by the web management interface scripts network_config.js and network_security.js. This lack of proper output encoding means that when an administrator views the DHCP lease table or ARP binding list through the browser-based GUI, the injected script executes within the context of the user's session.
From a technical perspective, this is classified as CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Stored XSS. Unlike reflected cross-site scripting where malicious payloads are delivered via links or forms that execute immediately and disappear, stored vulnerabilities persist on the server side. In this case, an attacker with local network access can craft a DHCP request or ARP packet containing script tags within the hostname field. Once the router accepts this information to update its lease table or binding list, the payload is saved permanently until manually cleared by an administrator. When any user accesses the web interface and navigates to these specific pages, the browser interprets the stored content as executable code rather than plain text, leading to immediate execution within the privileged context of the router's administrative panel.
The operational impact of this vulnerability is severe due to the high privilege level associated with accessing the Netcore NR255-V web management interface. An attacker positioned on the local area network can exploit this flaw to steal session cookies or authentication tokens, effectively hijacking the administrator's active session without needing valid credentials. This allows for complete compromise of the device configuration, enabling the attacker to modify DNS settings redirect traffic through malicious servers alter firewall rules to expose internal services or install persistent backdoors. Furthermore because the script executes in the context of the router's domain it can interact with all available API endpoints and administrative functions potentially leading to broader network infiltration if other vulnerabilities exist within the same interface framework.
This attack vector aligns closely with MITRE ATT&CK technique T1059 Command and Scripting Interpreter specifically JavaScript execution via browser-based interfaces as well as T1556 Modification of Authentication Credentials through session hijacking techniques facilitated by script injection. The ability to execute arbitrary code in the context of a trusted administrative interface represents a significant escalation from simple network reconnaissance or denial-of-service attacks typically associated with local attackers on unsecured networks.
Mitigation strategies for this vulnerability involve immediate firmware updates provided by Netcore if available which should include proper input validation and output encoding mechanisms such as HTML entity encoding to prevent script execution in the DOM. In cases where patching is not immediately possible administrators can implement network segmentation to restrict access to the management interface only from trusted IP addresses using VLAN isolation or firewall rules that block external administrative traffic. Additionally enabling HTTPS for all management sessions ensures that even if session tokens are stolen they cannot be easily intercepted via man-in-the-middle attacks though this does not prevent exploitation of the XSS flaw itself it reduces secondary risks associated with credential theft during transmission.