Stored Cross-Site Scripting in Netcore NR255-V Router
CVE-2026-76858

4.8MEDIUM

Key Information:

Vendor

Netcore

Status
Nr255-v
Vendor
CVE Published:
15 September 2026

What is CVE-2026-76858?

The Netcore NR255-V router, particularly version 1.5.130703, contains a stored cross-site scripting vulnerability. This issue arises from unsafe handling of the eval() function within the DDNS configuration, specifically in the ddns_wan_list_show.cgi script. Malicious users can exploit this vulnerability to inject harmful scripts through the DDNS configuration, which can persistently execute when the affected page is accessed. Users are encouraged to review their settings and update to secure their systems from this risk.

Affected Version(s)

NR255-V 1.5.130703

References

https://github.com/draw-ctf/netcore-router-public-refs/bl...
third-party-advisory
https://www.vulncheck.com/advisories/netcore-nr255-v-1.5....
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhou Ao
Yin Luxing
Jiang Yuxuan
Liu Xin
@Nebusec
.