# CVE-2026-76854: Netcore NR255-V sensitive information disclosure in l7_web_auth_user_show.cgi

Source: https://junglewise.ai/threats/cve-2026-76854-netcore-nr255-v-sensitive-information-disclosure-in-l7-web-auth  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76854 · Severity: medium · CVSS 6.5 · Published 2026-09-15

The Netcore NR255-V is a wireless router used in enterprise and residential networks. A vulnerability in its captive-portal authentication component exposes user credentials stored in the device, allowing attackers who access the web interface to retrieve login information for network users. This compromises the security of authenticated network access and could enable unauthorized access to the network.

Technologies: [Netcore NR255-V](https://junglewise.ai/threats/technologies/nr255-v). Vendors: [Netcore](https://junglewise.ai/threats/vendors/netcore).

## Quick answers

**Is CVE-2026-76854 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76854 being exploited in the wild.

**How severe is CVE-2026-76854?** Medium severity, with a CVSS score of 6.5, published 15 September 2026.

**Which products and versions are affected?** Netcore NR255-V 1.5.130703.

**Is there a fix for CVE-2026-76854?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76854 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-76854?** Check whether you run Netcore NR255-V at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a sensitive information disclosure flaw (CWE-522) in the l7_web_auth_user_show.cgi CGI script, which handles captive-portal user credential management. An authenticated attacker can query this web component to retrieve captive-portal user credentials in cleartext or weakly protected form. The attack vector is network-based and requires login credentials to the router's web interface. An attacker with administrative or authenticated access can extract credentials for all network users, compromising confidentiality of network authentication. No patch information is currently available in the advisory.

## Affected products

- Netcore NR255-V 1.5.130703

## Timeline

- 2026-09-04: disclosed
- 2026-09-15: advisory

## References

- [https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-captive-portal-cred-disclosure.md](https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-captive-portal-cred-disclosure.md)
- [https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-sensitive-information-disclosure-via-l7-web-auth-user-show-cgi](https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-sensitive-information-disclosure-via-l7-web-auth-user-show-cgi)

## Related threats

- [Netcore NR255-V stored cross-site scripting in L7 content management](https://junglewise.ai/threats/cve-2026-92257-netcore-nr255-v-stored-cross-site-scripting-in-l7-content)
- [Netcore NR255-V sensitive information disclosure in VPN configuration handlers](https://junglewise.ai/threats/cve-2026-92256-netcore-nr255-v-sensitive-information-disclosure-in-vpn)
- [Netcore NR255-V out-of-bounds read in filter_arp_put_file.cgi](https://junglewise.ai/threats/cve-2026-92255-netcore-nr255-v-out-of-bounds-read-in-filter-arp-put-file-cgi)
- [Netcore NR255-V stored cross-site scripting in DHCP and ARP hostname fields](https://junglewise.ai/threats/cve-2026-76873-netcore-nr255-v-stored-cross-site-scripting-in-dhcp-and-arp)
- [Netcore NR255-V stored cross-site scripting in DHCP and ACL management](https://junglewise.ai/threats/cve-2026-76872-netcore-nr255-v-stored-cross-site-scripting-in-dhcp-and-acl)