CVE-2026-76868

Received Received - Intake

Null Pointer Dereference in Netcore NR255-V Router

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in route_policy_add.cgi caused by a missing exit_port parameter. Attackers can send requests lacking the exit_port field to trigger the null pointer dereference, resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76868

EUVD

EUVD-2026-80040

Affected Vendors & Products

Vendor	Product	Version / Range
netcore	nr255-v	1.5.130703

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a null pointer dereference in Netcore NR255-V version 1.5.130703 caused by a missing exit_port parameter in route_policy_add.cgi. Attackers can exploit this by sending requests without the exit_port field, triggering a crash that results in a denial of service.

Detection Guidance

To detect this vulnerability, monitor for requests to route_policy_add.cgi without the exit_port parameter. Use network traffic analysis tools like tcpdump or Wireshark to capture and inspect HTTP requests targeting this endpoint. Check server logs for null pointer dereference errors or crashes in the Netcore NR255-V application.

Impact Analysis

The vulnerability allows attackers to cause a denial of service by crashing the affected system. This could disrupt network services or applications relying on the Netcore NR255-V device, leading to downtime or loss of connectivity.

Mitigation Strategies

Immediately update Netcore NR255-V to the latest version that fixes this issue. If an update is unavailable, restrict access to route_policy_add.cgi via firewall rules or disable the vulnerable feature. Implement input validation to ensure the exit_port parameter is always provided in requests.

Hi! I’m here to help you understand CVE-2026-76868. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70