CVE-2026-76863: Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the modqosbandwidth plan.json handling within filterconnsdumpcgi.c and IGDCgiCall.c. Authenticated users with broad roles can access these QoS read routes to obtain live network telemetry beyond their intended privilege level.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netcore NR255-Vto a version that resolves this vulnerability.Fixed in 1.5.130703 - Upgrade
Upgrade
Netcore NR255-Vto a version that resolves this vulnerability.Fixed in 1.5.130703Patch Sensitive Information Disclosure via QoS Bandwidth Plan Routes
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with a broad role can access the affected QoS read routes. The disclosed data is live network telemetry that exceeds that user's intended privilege level.
Does exploitation require user interaction or a complex attack?
No user interaction is required, and the listed attack complexity is low. Exploitation does require valid authentication and a sufficiently broad assigned role.
What is the impact of successful exploitation?
The impact is limited to confidentiality: an affected user can obtain sensitive live network telemetry. The provided assessment indicates no integrity or availability impact.