CVE-2026-76854: Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7webauthusershow.cgi related to captive-portal credential handling. Attackers can query this component to obtain captive-portal user credentials, compromising confidentiality of authenticated network access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netcore NR255-V l7_web_auth_user_show.cgito a version that resolves this vulnerability.Fixed in 1.5.130703
Event History
Frequently Asked Questions
What level of access does an attacker need to retrieve the disclosed credentials?
The vulnerability is remotely reachable over the network and has low attack complexity, but exploitation requires low-level privileges. No user interaction is required.
What information is exposed if the issue is exploited?
An attacker can obtain captive-portal user credentials through the affected component. The stated impact is high confidentiality loss, which can compromise authenticated network access.
Which device version is identified as affected?
The reported affected product is Netcore NR255-V version 1.5.130703. The provided information does not identify other affected versions, fixed versions, or mitigations.