Is CVE-2026-76872 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76872 being exploited in the wild.

How severe is CVE-2026-76872?

Medium severity, with a CVSS score of 5.4, published 15 September 2026.

Is there a fix for CVE-2026-76872?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76872 attacked?

It is attacked over the network.

Am I affected by CVE-2026-76872?

Check whether you run Netcore NR255-V at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76872: Netcore NR255-V stored cross-site scripting in DHCP and ACL management

CVE-2026-76872 · Severity: medium · CVSS 5.4 · Published 2026-09-15

The Netcore NR255-V is a wireless router used to manage network connections in homes and small offices. This vulnerability allows an attacker with access to the router's web management interface to inject malicious scripts that persist in the system and execute in the browsers of other users who access the same interface. This could allow attackers to steal administrator credentials, modify network settings, or intercept user traffic.

Technologies: Netcore NR255-V. Vendors: Netcore.

Quick answers

Is CVE-2026-76872 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76872 being exploited in the wild.
How severe is CVE-2026-76872?: Medium severity, with a CVSS score of 5.4, published 15 September 2026.
Which products and versions are affected?: Netcore NR255-V 1.5.130703.
Is there a fix for CVE-2026-76872?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76872 attacked?: It is attacked over the network.
Am I affected by CVE-2026-76872?: Check whether you run Netcore NR255-V at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (XSS) vulnerability (CWE-79) affecting multiple DHCP and IP ACL management components: dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. The vulnerability stems from insufficient input validation when processing configuration data in these components. An authenticated attacker with administrative access to the web interface can inject malicious JavaScript through DHCP static IP or IP ACL fields; the payload is stored server-side and executed in the browsers of any user accessing the affected management pages. Attack requires authentication and user interaction (visiting the vulnerable page), but once injected, the XSS is persistent and affects all subsequent users. No patch information is currently available.

Affected products

Netcore NR255-V 1.5.130703

Timeline

2026-09-15: disclosed: CVE-2026-76872 published
2026-09-04: other: GitHub disclosure reference dated 2026-09-04

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.