CVE-2026-76858: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddnswanlistshow.cgi caused by unsafe eval() handling of DDNS data. Attackers can inject malicious script through the DDNS configuration path, leading to persistent execution when the affected page is viewed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netcore NR255-Vto a version that resolves this vulnerability.Fixed in 1.5.130703 - Compensating control
Mitigate stored XSS persistence by restricting access to the affected page/functionality that includes ddns_wan_list_show.cgi until the DDNS vulnerability is remediated.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs privileges sufficient to modify the DDNS configuration, because the malicious script is injected through the DDNS configuration path. A victim must subsequently view the affected DDNS page for the stored script to execute.
Who is exposed to the stored script?
Users who view the affected ddns_wan_list_show.cgi page after malicious DDNS data has been saved are exposed to script execution in their browser. The vulnerability has scope changed, indicating the impact can extend beyond the privileges of the user who initially stored the payload.
How can I determine whether the device may be affected?
Verify whether the device is a Netcore NR255-V running version 1.5.130703 and inspect its DDNS configuration for unexpected or untrusted values. Review access to the DDNS configuration path and treat suspicious entries as potentially containing stored script.