CVE-2026-76873: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list display components handling hostname fields. A LAN-based attacker can inject malicious script through these hostname fields, which is later rendered by networkconfig.js and networksecurity.js in the web management interface.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netcore NR255-Vto a version that resolves this vulnerability.Fixed in 1.5.130703
Event History
Frequently Asked Questions
Who can exploit this issue?
A LAN-based attacker can inject a malicious hostname through DHCP or ARP-related hostname fields. No authenticated management-interface access is identified as a prerequisite in the provided data.
When is the injected content triggered?
The malicious hostname is stored and later rendered in the router's web management interface, specifically in the DHCP dynamic IP display or ARP bind list display components.
Which systems should be investigated?
Investigate Netcore NR255-V devices running version 1.5.130703, particularly where administrators use the DHCP dynamic IP display or ARP bind list pages.