CVE-2026-76865: Netcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter Handlers
Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filterconndelcgi.c and grepriosetcgi.c due to unchecked atoi() results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netcore NR255-Vto a version that resolves this vulnerability.Fixed in 1.5.130703 - Compensating control
Mitigate denial of service by restricting access to the QoS setter CGI handlers filter_conn_del_cgi.c and gre_prio_set_cgi.c until the device is patched
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The reported CVSS vector requires high privileges (PR:H). The available information does not identify the specific authenticated role or interface permissions needed to reach the affected QoS CGI handlers.
What is the impact if exploitation succeeds?
A crafted request to the affected QoS setter handlers can trigger a null pointer dereference and cause a denial of service. No confidentiality or integrity impact is indicated by the supplied CVSS vector.
Which components are affected?
The issue is reported in the QoS setter CGI handlers filter_conn_del_cgi.c and gre_prio_set_cgi.c in Netcore NR255-V version 1.5.130703.