CVE-2026-76866: Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters
Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSsetcgi.c and related ddnsProc.c components, enabling os command argument injection. Attackers can exploit the unsanitized parameters to inject additional command arguments executed with root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate by blocking or restricting access to the DDNS CGI/endpoint that calls into DDNSset_cgi.c and related ddns_Proc.c, until the firmware is updated.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The supplied vector indicates that an attacker needs high privileges and can exploit the issue over the network without user interaction. The vulnerable DDNS parameters must be reachable to that authenticated attacker.
What is the impact of successful exploitation?
Injected command arguments are executed with root privileges. This can result in full compromise of confidentiality, integrity, and availability on the affected device.
Which firmware version is identified as affected?
The provided information identifies Netcore NR255-V firmware version 1.5.130703. No other affected or fixed versions are specified.