CVE-2026-76873

Received Received - Intake

Stored XSS in Netcore NR255-V Router

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components handling hostname fields. A LAN-based attacker can inject malicious script through these hostname fields, which is later rendered by network_config.js and network_security.js in the web management interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-76873

EUVD

EUVD-2026-80045

Affected Vendors & Products

Vendor	Product	Version / Range
netcore	nr255-v	1.5.130703

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Netcore NR255-V version 1.5.130703. It allows a LAN-based attacker to inject malicious scripts via hostname fields in DHCP dynamic IP display and ARP bind list display. These scripts are later rendered in the web management interface through network_config.js and network_security.js.

Detection Guidance

To detect this vulnerability, inspect network devices running Netcore NR255-V version 1.5.130703 for suspicious hostname entries in DHCP dynamic IP or ARP bind list displays. Check network_config.js and network_security.js for unexpected script content in hostname fields.

Impact Analysis

An attacker could exploit this to execute malicious scripts in the context of the web management interface, potentially stealing session cookies, performing actions on behalf of the user, or redirecting to malicious sites. This could lead to unauthorized access or data theft if the user is logged into the interface.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, which may violate GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations using this device may face compliance risks if the vulnerability is exploited.

Mitigation Strategies

Immediately update Netcore NR255-V to a patched version. If an update is unavailable, disable the web management interface or restrict LAN access to it. Monitor hostname fields in DHCP and ARP lists for unauthorized script injections.

Hi! I’m here to help you understand CVE-2026-76873. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70