CVE-2026-92257 in NR255-V
Summary
by MITRE • 09/16/2026
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Netcore NR255-V router running firmware version 1.5.130703 is susceptible to a critical stored cross-site scripting vulnerability within its Layer 7 application control and management interface. This flaw specifically impacts components responsible for handling call board text configurations and policy group definitions, which rely on the JavaScript eval() function as an execution sink. The presence of this dynamic code evaluation mechanism in user-facing administrative pages creates a significant security gap where input validation is insufficient to sanitize malicious script payloads before they are processed by the browser environment.
The technical nature of this vulnerability stems from the improper handling of unsanitized user-supplied data within the L7 content management subsystems. When an administrator or authorized user inputs text into fields associated with call boards or policy groups, the system fails to adequately escape special characters that could be interpreted as executable JavaScript code. Because these pages utilize eval() to process certain configuration parameters, any injected script tags or event handlers are not merely displayed but actively executed by the victim's web browser upon subsequent access to those specific management sections. This architectural decision transforms standard input fields into vectors for persistent malicious code injection rather than simple data storage errors.
The operational impact of this vulnerability is severe due to its stored nature, meaning that once a payload is injected and saved within the router’s configuration database, it remains active until manually removed by an administrator. Unlike reflected XSS attacks which require tricking users into clicking specific links, this flaw allows attackers to plant persistent traps. Any user with access to the administrative interface who views the compromised call board text or policy group settings will have their session hijacked, credentials stolen, or browser controlled without further interaction from the attacker. This persistence ensures that the attack surface remains open continuously, affecting all subsequent sessions and potentially compromising the entire network infrastructure managed by this device if an administrator’s account is taken over.
From a classification perspective, this vulnerability aligns with CWE-79, known as Improper Neutralization of Input During Web Page Generation commonly referred to as Cross-site Scripting (XSS). The specific use of eval() for processing user input also highlights issues related to CWE-95, which addresses the improper neutralization of directives used in code evaluation. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates techniques associated with Client-side Injection and potentially Account Manipulation or Credential Access if session tokens are exfiltrated. The ability to execute arbitrary JavaScript within an administrative context elevates the risk from a mere privacy concern to a critical infrastructure compromise vector.
Mitigation strategies for this issue must prioritize immediate software updates provided by Netcore, as patching typically involves replacing unsafe eval() calls with safer alternatives like JSON.parse or implementing strict Content Security Policy headers that restrict script execution sources. In environments where updating is not immediately feasible, network segmentation should be enforced to isolate the management interface from untrusted networks, ensuring that only authorized IP addresses can access these L7 configuration pages. Additionally, administrators should implement rigorous input validation on any custom scripts deployed alongside such devices and regularly audit user inputs for encoded script tags or event handler attributes like onload or onclick that could trigger execution within vulnerable sinks.