Executive brief
The Netcore NR255-V is a wireless router used to provide network connectivity and manage traffic routing in homes and small businesses. This vulnerability allows an attacker with administrative access to inject malicious scripts into the router's routing and NAT configuration pages. When other administrators view these pages, the injected scripts execute in their browser, potentially allowing credential theft, session hijacking, or unauthorized configuration changes.
Technical details
This is a stored cross-site scripting (XSS) vulnerability (CWE-79) affecting multiple CGI components: routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, and route_policy_parame_show_cgi. The root cause is improper input neutralization in these components, which use eval() and HTML sinks without proper sanitization. An authenticated attacker can inject persistent malicious script payloads through route and NAT configuration pages; these payloads are stored and executed when other administrators view the affected pages. The vulnerability requires authentication and user interaction (viewing the configuration page), but the stored nature makes it particularly dangerous in multi-user administrative environments. Patches should be available from Netcore for firmware versions after 1.5.130703.
Affected products
- Netcore NR255-V 1.5.130703
Timeline
- 2026-09-04: disclosed
- 2026-09-15: advisory