CVE-2026-76857: Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgi

Published Sep 15, 2026

Updated

Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddnswanlistshow.cgi endpoint and related DDNSsetcgi, IGDGetCgiHandler, and IGDCgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing sensitive account information.

Affected Software

1 affected component

Netcore Netcore NR255-V=1.5.130703

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Netcore NR255-V to a version that resolves this vulnerability.
Fixed in 1.5.130703

Event History

Sep 15, 2026

CVE Published

via MITRE·09:57 PM

Data Sourced

via MITRE·09:57 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to retrieve the DDNS credentials?

The vulnerability requires low-level privileges (PR:L). The provided data does not indicate that unauthenticated attackers can exploit it.

Which deployments are affected?

The affected product and version identified are Netcore NR255-V firmware 1.5.130703. The data does not establish whether other firmware versions or default configurations are affected.

What information can be exposed through this issue?

An attacker able to reach the affected CGI handler can obtain DDNS credentials in plaintext, exposing the associated sensitive account information.