CVE-2026-76865

Received Received - Intake

Null Pointer Dereference in Netcore NR255-V

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filter_conn_del_cgi.c and gre_prio_set_cgi.c due to unchecked atoi() results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76865

EUVD

EUVD-2026-80037

Affected Vendors & Products

Vendor	Product	Version / Range
netcore	nr255-v	1.5.130703

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a null pointer dereference flaw in Netcore NR255-V version 1.5.130703. It exists in the QoS setter CGI handlers named filter_conn_del_cgi.c and gre_prio_set_cgi.c. The issue arises because the atoi() function results are not checked, allowing crafted input to trigger a denial of service by causing a null pointer dereference.

Detection Guidance

To detect this vulnerability, inspect network traffic for requests targeting the QoS setter CGI handlers (filter_conn_del_cgi.c or gre_prio_set_cgi.c) on Netcore NR255-V devices. Check for malformed input that may cause null pointer dereferences. Monitor system logs for crashes or denial of service events in these handlers.

Impact Analysis

An attacker could exploit this flaw by sending specially crafted input to the affected CGI handlers. This could lead to a denial of service, causing the system to crash or become unresponsive. Systems using the vulnerable Netcore NR255-V version 1.5.130703 are at risk.

Mitigation Strategies

Immediately update Netcore NR255-V to the latest firmware version that patches this vulnerability. If an update is unavailable, disable the affected QoS setter CGI handlers (filter_conn_del_cgi.c and gre_prio_set_cgi.c) to prevent exploitation. Restrict network access to these handlers via firewall rules.

Hi! I’m here to help you understand CVE-2026-76865. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70