CVE-2026-92256

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-15

Last updated on: 2026-09-16

Assigner: VulnCheck

Description

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json read handlers. Attackers can query l2tpd_config_show.cgi to expose stored IPsec PSK and RSA key material.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-16

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-05

NVD

CVE-2026-92256

EUVD

EUVD-2026-80047

Affected Vendors & Products

Vendor	Product	Version / Range
Netcore	NR255-V	1.5.130703

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability is a sensitive information disclosure issue in NR255-V version 1.5.130703. It allows attackers to access stored IPsec pre-shared keys (PSK) and RSA key material by querying specific CGI endpoints like l2tpd_config_show.cgi, ipsec_show.cgi, and mod_vpn_remote/plan.json.

Detection Guidance

Check for unauthorized access to l2tpd_config_show.cgi, ipsec_show.cgi, or mod_vpn_remote/plan.json endpoints. Monitor logs for unusual queries to these paths. Verify if IPsec PSK or RSA key material is exposed in responses.

Impact Analysis

Attackers could exploit this to steal cryptographic keys, decrypt communications, or impersonate legitimate users. This could lead to unauthorized access to networks, data breaches, or further attacks on connected systems.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data exposure. GDPR requires protection of personal data, while HIPAA mandates safeguarding sensitive health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Update NR255-V to the latest version. Restrict access to the vulnerable CGI endpoints via firewall rules. Rotate all exposed IPsec PSK and RSA keys immediately. Disable unnecessary services if not in use.

Hi! I’m here to help you understand CVE-2026-92256. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70