CVE-2026-92256 in NR255-V
Summary
by MITRE • 09/16/2026
NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json read handlers. Attackers can query l2tpd_config_show.cgi to expose stored IPsec PSK and RSA key material.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability represents a critical failure in access control mechanisms within the NR255-V network device firmware, specifically affecting version 1.5.130703. This flaw is rooted in improper handling of sensitive configuration data by several CGI scripts and JSON read handlers, including l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json. These components are designed to display or manage network settings but fail to enforce adequate authentication or authorization checks before returning internal state information to the requester. Consequently, any user with access to these endpoints can retrieve configuration details that should remain strictly confidential, leading to a severe compromise of system integrity and security posture.
The technical nature of this flaw is classified as an improper restriction of sensitive information exposure within untrusted interfaces. When attackers query l2tpd_config_show.cgi or ipsec_show_cgi.c without proper privileges, the systems respond by exposing stored Internet Protocol Security Pre-Shared Keys (PSK) and RSA key material. This constitutes a direct violation of confidentiality principles, as cryptographic keys are essential for establishing secure tunnels and verifying identities in VPN connections. The exposure of these secrets allows malicious actors to decrypt previously captured traffic or impersonate legitimate devices within the network infrastructure. Furthermore, the inclusion of mod_vpn_remote/plan.json indicates that this vulnerability extends beyond simple configuration viewing scripts into broader remote management interfaces, increasing the attack surface significantly for any entity capable of reaching these endpoints over the network.
From an operational perspective, the impact of this vulnerability is profound and potentially catastrophic depending on the deployment environment. The disclosure of IPsec PSKs enables attackers to establish their own VPN tunnels using valid credentials, effectively bypassing authentication controls and gaining unauthorized access to protected internal networks. Similarly, the exposure of RSA key material can facilitate man-in-the-middle attacks or allow for the forgery of digital signatures used in secure communications. This level of information disclosure undermines trust in the network perimeter and compromises the confidentiality and integrity of all data transmitted through these VPN channels. In enterprise environments, this could lead to lateral movement by attackers who have already breached external defenses, as they can leverage stolen keys to move deeper into the infrastructure without triggering typical authentication-based alerts.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-200, which defines exposure of sensitive information to an unauthorized actor. It also maps closely to MITRE ATT&CK technique T1530, Data from Local System, where adversaries collect data stored on local devices for later exfiltration or immediate use in further attacks. The specific mechanism involves exploiting misconfigured web server handlers that serve internal configuration files without validating the requester's role or permissions. This is a classic example of broken access control leading to sensitive data exposure, often resulting from developers prioritizing functionality over security during the implementation of management interfaces.
Mitigation strategies must focus on immediate remediation and long-term architectural improvements. The most effective solution is to apply vendor-provided patches that update the firmware to a version where these CGI scripts enforce strict role-based access control. Administrators should ensure that only authenticated users with specific administrative privileges can invoke l2tpd_config_show.cgi or ipsec_show_cgi.c, ideally restricting such access to local console sessions rather than remote web interfaces if possible. Additionally, implementing network segmentation to isolate management planes from general user traffic reduces the risk of exploitation by external attackers. Long-term fixes should include auditing all CGI scripts for similar flaws and adopting secure coding practices that mandate input validation and output sanitization. Regular vulnerability assessments and penetration testing focused on authentication bypasses will help identify and rectify such weaknesses before they can be exploited in production environments.