CVE-2026-76860

Received Received - Intake

Stack-Based Buffer Overflow in Netcore NR255-V

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in wake_up_set.cgi caused by unbounded tokenization of MAC and ID input. Attackers can supply crafted MAC and ID values to the affected endpoint to overflow the stack buffer and corrupt program memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76860

EUVD

EUVD-2026-80063

Affected Vendors & Products

Vendor	Product	Version / Range
netcore	nr255-v	1.5.130703

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability is a stack-based buffer overflow in Netcore NR255-V version 1.5.130703. It occurs in the wake_up_set.cgi endpoint due to unbounded tokenization of MAC and ID input. Attackers can exploit this by sending specially crafted MAC and ID values to overflow the stack buffer, corrupting program memory.

Detection Guidance

Detecting this vulnerability requires checking for the presence of Netcore NR255-V version 1.5.130703 and monitoring for unusual activity on the wake_up_set.cgi endpoint. Inspect network traffic for malformed MAC or ID values sent to this endpoint. Use tools like Wireshark to capture and analyze HTTP requests targeting the affected CGI script.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the affected device, potentially gaining control over it. This may lead to unauthorized access, data theft, or disruption of services. Systems using the vulnerable Netcore NR255-V version are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Immediately update Netcore NR255-V to a patched version if available. If no patch exists, restrict access to the wake_up_set.cgi endpoint via firewall rules or disable it entirely. Monitor system logs for signs of exploitation attempts and consider isolating the affected device from critical network segments.

Hi! I’m here to help you understand CVE-2026-76860. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70