Stack-Based Buffer Overflow in Netcore NR255-V by Netcore
CVE-2026-76861

8.7HIGH

Key Information:

Vendor

Netcore

Status
Nr255-v
Vendor
CVE Published:
15 September 2026

What is CVE-2026-76861?

The Netcore NR255-V device, specifically version 1.5.130703, contains a vulnerability characterized by a stack-based buffer overflow. This flaw occurs in the ntools_tcpdump_start_set.cgi script due to an unsized sprintf function call when handling form inputs. An attacker can exploit this vulnerability by sending specially crafted inputs to the affected CGI endpoint, which may result in a buffer overflow, allowing the potential execution of arbitrary code on the device.

Affected Version(s)

NR255-V 1.5.130703

References

https://github.com/draw-ctf/netcore-router-public-refs/bl...
third-party-advisory
https://www.vulncheck.com/advisories/netcore-nr255-v-1.5....
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhou Ao
Yin Luxing
Jiang Yuxuan
Liu Xin
@Nebusec
.