CVE-2026-76867: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers
Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routingtabaddcgi, routingtablelistshowcgi, routepolicyaddcgi, and routepolicyparameshowcgi. Attackers can inject persistent script payloads through these route and NAT configuration pages, which are then executed in the context of users viewing the affected pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netcore NR255-Vto a version that resolves this vulnerability.Fixed in 1.5.130703 - Compensating control
Mitigate the stored XSS impact by restricting access to the affected route and NAT configuration pages (and the CGI handlers routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, and route_policy_parame_show_cgi) to trusted administrators only.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs low-privileged access to the affected device and must be able to submit values through the route or NAT configuration pages. Exploitation also requires a user to view a page that renders the stored payload.
Who is exposed to the stored payload?
Users who view the affected routing or NAT configuration pages can have injected script execute in their browser context. The affected CGI components include routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, and route_policy_parame_show_cgi.
How can I determine whether a device is affected?
Verify whether the device is a Netcore NR255-V running firmware version 1.5.130703. Review route and NAT configuration entries for unexpected or suspicious script content, particularly entries created by lower-privileged users.