CVE-2026-76864: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names
NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qosxianzaddcgi, qosxianzshowcgi, qosfilteraddcgi, and qosfiltershowcgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is later processed by the affected handlers.'
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NR255-Vto a version that resolves this vulnerability.Fixed in 1.5.130703
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack requires high privileges and user interaction. A privileged attacker must submit a crafted QoS rule name, and the stored payload executes later when affected QoS handlers process the saved data.
Which interfaces are affected by the unsanitized QoS rule name?
The affected handlers are qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi. These handlers parse QoS rule names using eval() without sanitizing them.
What is the likely impact if exploitation succeeds?
The vulnerability allows persistent script code to execute in a later processing context. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact, and a scope change.