CVE-2026-76867

Received Received - Intake

Stored XSS in Netcore NR255-V Firmware

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, and route_policy_parame_show_cgi. Attackers can inject persistent script payloads through these route and NAT configuration pages, which are then executed in the context of users viewing the affected pages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76867

EUVD

EUVD-2026-80039

Affected Vendors & Products

Vendor	Product	Version / Range
netcore	nr255-v	1.5.130703

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Netcore NR255-V firmware version 1.5.130703. It exists in routing and NAT configuration CGI components like routing_tab_add_cgi and routing_table_list_show_cgi. Attackers can inject malicious scripts into these configuration pages, which are then executed when other users view the affected pages.

Detection Guidance

This vulnerability involves stored XSS in Netcore NR255-V firmware routing and NAT configuration pages. To detect it, inspect HTTP requests and responses to routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, and route_policy_parame_show_cgi for suspicious script payloads in parameters or output. Check for unusual JavaScript execution in these pages.

Impact Analysis

This vulnerability allows attackers to inject persistent scripts into configuration pages. If you access these pages, the injected scripts could steal your session cookies, redirect you to malicious sites, or perform actions on your behalf without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using this firmware may face compliance violations if user data is compromised.

Mitigation Strategies

Update the Netcore NR255-V firmware to the latest version that addresses the stored cross-site scripting vulnerability in routing and NAT configuration CGI components. Disable or restrict access to the vulnerable CGI components (routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, route_policy_parame_show_cgi) if updates are not immediately available.

Hi! I’m here to help you understand CVE-2026-76867. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70