CVE-2026-76872: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcpaddstaticipcgi, dhcpstaticipshowcgi, ipaclsetcgi, and ipaclshowcgi. Attackers can inject persistent malicious scripts through these components to compromise the web management interface for other users.'
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the NR255-V web management interface are exposed if malicious content has been stored through the DHCP static IP or IP ACL management functions. The issue can affect other users who later view the affected management pages.
What does an attacker need to exploit it?
The attacker needs low-privileged access and must convince another user to interact with the affected web management interface. Exploitation involves submitting malicious script content through the DHCP static IP or IP ACL management components so it is stored and later rendered.
Which management functions should be reviewed for malicious stored entries?
Review DHCP static IP and IP ACL entries, particularly data handled by dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Stored script content in these areas may execute when the corresponding management pages are viewed.