CVE-2026-92257: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netcore NR255-Vto a version that resolves this vulnerability.Fixed in 1.5.130703
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack requires low-privileged access to the affected management interface. The attack vector is network-based.
What must happen for the injected code to execute?
A user must view the affected stored content after a payload has been injected. The malicious script executes in the context of users who view that content.
Which systems should be prioritized for investigation?
Prioritize Netcore NR255-V devices running version 1.5.130703 where L7 content management features, including call board text or policy group handling, are in use.