CVE-2026-76872

Received Received - Intake

Stored XSS in Netcore NR255-V Router

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Attackers can inject persistent malicious scripts through these components to compromise the web management interface for other users.'

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76872

EUVD

EUVD-2026-80044

Affected Vendors & Products

Vendor	Product	Version / Range
netcore	nr255-v	1.5.130703

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Netcore NR255-V version 1.5.130703. It exists in DHCP static IP and IP ACL management pages, such as dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Attackers can inject malicious scripts that persist on these pages, compromising the web management interface for other users.

Impact Analysis

If you use the affected Netcore NR255-V version, attackers could exploit this flaw to inject persistent malicious scripts. This could lead to unauthorized access to your web management interface, theft of session cookies, or manipulation of displayed data, potentially compromising your network's security.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR's data protection requirements or HIPAA's security rules. Non-compliance with these regulations can result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Netcore NR255-V device to the latest firmware version that addresses the stored XSS vulnerability in DHCP static IP and IP ACL management pages. Disable or restrict access to the vulnerable web management interface pages until patched. Monitor network traffic for suspicious activity targeting these interfaces.

Hi! I’m here to help you understand CVE-2026-76872. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70