CVE-2026-92257

Deferred Deferred - Pending Action

Stored XSS in Netcore NR255-V L7 Content Management

Publication date: 2026-09-15

Last updated on: 2026-09-24

Assigner: VulnCheck

Description

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-24

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-92257

EUVD

EUVD-2026-80048

Affected Vendors & Products

Vendor	Product	Version / Range
netcore	nr255-v	1.5.130703

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Netcore NR255-V version 1.5.130703. It exists in L7 content management pages that use eval() functions, specifically affecting call board text and policy group handling components. Attackers can inject malicious scripts that persist in the system and execute when other users view the affected content.

Impact Analysis

This vulnerability allows attackers to inject persistent malicious scripts into web pages. If you are a user of the affected Netcore NR255-V system, visiting compromised pages could result in unauthorized execution of scripts in your browser, potentially leading to session hijacking, data theft, or defacement of the web interface.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using the affected software may face compliance violations if user data is compromised due to this flaw.

Mitigation Strategies

Update Netcore NR255-V to the latest version that patches the stored XSS vulnerability in L7 content management pages. Review and sanitize user inputs in call board text and policy group handling components to prevent script injection. Implement input validation and output encoding to mitigate XSS risks.

Hi! I’m here to help you understand CVE-2026-92257. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70