CVE-2026-76871

Deferred Deferred - Pending Action

Sensitive Information Disclosure in Netcore NR255-V

Publication date: 2026-09-15

Last updated on: 2026-09-21

Assigner: VulnCheck

Description

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-21

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76871

EUVD

EUVD-2026-80043

Affected Vendors & Products

Vendor	Product	Version / Range
netcore	nr255-v	1.5.130703

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability is a sensitive information disclosure issue in Netcore NR255-V version 1.5.130703. It allows attackers to access PPTP and L2TP VPN credentials through specific files and scripts like mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi.

Detection Guidance

Check for unauthorized access to mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, or l2tpd_user_show.cgi on your Netcore NR255-V device. Inspect logs for unusual requests to these endpoints.

Impact Analysis

If you use Netcore NR255-V version 1.5.130703, attackers could steal your VPN credentials. This could lead to unauthorized access to your network, data breaches, or further attacks on connected systems.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access. GDPR requires protecting personal data, while HIPAA mandates securing health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Update the Netcore NR255-V firmware to the latest version. Restrict access to the vulnerable endpoints via firewall rules. Rotate all VPN credentials immediately.

Hi! I’m here to help you understand CVE-2026-76871. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70