Executive brief
The Netcore NR255-V is a wireless router used to manage network connections in homes and small offices. This vulnerability allows an attacker with access to the router's web management interface to inject malicious scripts that persist in the system and execute in the browsers of other users who access the same interface. This could allow attackers to steal administrator credentials, modify network settings, or intercept user traffic.
Technical details
This is a stored cross-site scripting (XSS) vulnerability (CWE-79) affecting multiple DHCP and IP ACL management components: dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. The vulnerability stems from insufficient input validation when processing configuration data in these components. An authenticated attacker with administrative access to the web interface can inject malicious JavaScript through DHCP static IP or IP ACL fields; the payload is stored server-side and executed in the browsers of any user accessing the affected management pages. Attack requires authentication and user interaction (visiting the vulnerable page), but once injected, the XSS is persistent and affects all subsequent users. No patch information is currently available.
Affected products
- Netcore NR255-V 1.5.130703
Timeline
- 2026-09-15: disclosed: CVE-2026-76872 published
- 2026-09-04: other: GitHub disclosure reference dated 2026-09-04