CVE-2026-76854

Received Received - Intake

Sensitive Information Disclosure in Netcore NR255-V

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cgi related to captive-portal credential handling. Attackers can query this component to obtain captive-portal user credentials, compromising confidentiality of authenticated network access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76854

EUVD

EUVD-2026-80057

Affected Vendors & Products

Vendor	Product	Version / Range
netcore	nr255-v	1.5.130703

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability is a sensitive information disclosure issue in Netcore NR255-V version 1.5.130703. It involves the component l7_web_auth_user_show.cgi, which handles captive-portal credentials. Attackers can exploit this to query the component and retrieve user credentials, exposing confidential information used for authenticated network access.

Detection Guidance

Check for unauthorized access to l7_web_auth_user_show.cgi by monitoring web server logs for suspicious queries to this endpoint. Look for repeated requests or unusual patterns indicating credential harvesting attempts.

Impact Analysis

If exploited, attackers could gain access to captive-portal user credentials. This could allow unauthorized individuals to bypass authentication mechanisms, access restricted networks, or impersonate legitimate users. The impact includes compromised confidentiality and potential unauthorized network access.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA. Exposure of user credentials may result in unauthorized data access, violating confidentiality requirements. Organizations may face legal penalties, reputational damage, and increased scrutiny for failing to protect sensitive information.

Mitigation Strategies

Immediately update Netcore NR255-V to the latest patched version. Disable or restrict access to l7_web_auth_user_show.cgi if updates are unavailable. Implement network segmentation to limit exposure of captive-portal components.

Hi! I’m here to help you understand CVE-2026-76854. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70