CVE-2026-76855: Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7webauthlogdumpcgi.c, auditgetcgi.c, and moddispatchauth/plan.json. Attackers can query these audit components to obtain other users' session and browsing history data across sessions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netcore NR255-Vto a version that resolves this vulnerability.Fixed in 1.5.130703 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Cross-User Session Disclosure via Audit Endpoints
Event History
Frequently Asked Questions
What level of access does an attacker need to retrieve other users' data?
The vulnerability requires low-privileged access. An attacker does not need user interaction, and the attack can be performed over the network.
What information could be exposed?
Affected audit components can disclose other users' session data and browsing history across sessions. The reported impact is limited to confidentiality; integrity and availability are not identified as affected.
How can I determine whether a device is affected?
Verify whether the device is a Netcore NR255-V running version 1.5.130703 and whether its audit endpoints are reachable by low-privileged authenticated users. The affected components include l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and mod_dispatch_auth/plan.json.