CVE-2026-76864

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-15

Last updated on: 2026-09-17

Assigner: VulnCheck

Description

NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is later processed by the affected handlers.'

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-17

Generated

2026-10-19

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-76864

EUVD

EUVD-2026-80036

Affected Vendors & Products

Vendor	Product	Version / Range
Netcore	NR255-V	1.5.130703

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

NR255-V version 1.5.130703 does not properly sanitize QoS rule names before processing them via eval() in specific CGI handlers. This allows an attacker to inject malicious script code through crafted QoS rule name input. The injected code executes when the stored data is later processed by the affected handlers.

Detection Guidance

This vulnerability involves persistent script code injection via QoS rule names in NR255-V version 1.5.130703. To detect it, inspect QoS rule names for unusual or obfuscated characters, especially in handlers like qos_xianz_add_cgi or qos_filter_add_cgi. Check logs for eval() function usage in these contexts.

Impact Analysis

An attacker could exploit this to execute persistent cross-site scripting (XSS) attacks. This may lead to unauthorized access to user sessions, theft of sensitive data, or manipulation of displayed content. The impact depends on the privileges of the affected application and the context in which the CGI handlers are used.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's integrity and confidentiality principles. For HIPAA, it may compromise protected health information (PHI) integrity. Compliance risks include potential fines, reputational damage, and mandatory breach notifications under these regulations.

Mitigation Strategies

Update NR255-V to the latest version that patches the eval() sanitization issue in QoS rule handlers. If an update is unavailable, disable or restrict access to the affected CGI handlers (qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, qos_filter_show_cgi) until a fix is applied.

Hi! I’m here to help you understand CVE-2026-76864. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70