CVE-2026-76868: Netcore NR255-V 1.5.130703 NULL Pointer Dereference in route_policy_add.cgi via Missing exit_port

Published Sep 15, 2026

Updated

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in routepolicyadd.cgi caused by a missing exitport parameter. Attackers can send requests lacking the exitport field to trigger the null pointer dereference, resulting in a denial of service.

Affected Software

1 affected component

Netcore NR255-V=1.5.130703

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Netcore NR255-V to a version that resolves this vulnerability.
Fixed in 1.5.130703
Compensating control
Mitigate the denial of service by preventing/validating requests to route_policy_add.cgi that omit the exit_port field (ensure exit_port is required and rejects requests missing it).

Event History

Sep 15, 2026

CVE Published

via MITRE·09:57 PM

Data Sourced

via MITRE·09:57 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability requires high privileges. An attacker must be able to send requests to the route_policy_add.cgi endpoint with the exit_port parameter omitted.

What is the impact of successful exploitation?

Successful exploitation causes a null pointer dereference and can result in denial of service. The provided data does not indicate confidentiality or integrity impact.