OS Command Argument Injection in Netcore NR255-V Router Firmware
CVE-2026-76866

8.6HIGH

Key Information:

Vendor

Netcore

Status
Nr255-v
Vendor
CVE Published:
15 September 2026

What is CVE-2026-76866?

The Netcore NR255-V Router firmware version 1.5.130703 contains a critical vulnerability that allows attackers to exploit unquoted user-supplied input within the DDNS settings. Specifically, the vulnerability arises from unsanitized parameters processed in the DDNSset_cgi.c and ddns_Proc.c components, which can lead to OS command argument injection. By crafting malicious DDNS input, an attacker could manipulate command lines that get executed with root privileges, thereby compromising the overall security and integrity of the router.

Affected Version(s)

NR255-V 1.5.130703

References

https://github.com/draw-ctf/netcore-router-public-refs/bl...
third-party-advisory
https://www.vulncheck.com/advisories/netcore-nr255-v-1.5....
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhou Ao
Yin Luxing
Jiang Yuxuan
Liu Xin
@Nebusec
.