Sensitive Information Disclosure in Netcore NR255-V by Netcore
CVE-2026-76871

7.1HIGH

Key Information:

Vendor

Netcore

Status
Nr255-v
Vendor
CVE Published:
15 September 2026

What is CVE-2026-76871?

The Netcore NR255-V version 1.5.130703 is susceptible to a sensitive information disclosure vulnerability that affects its VPN management components. Specifically, the flawed handling of responses in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi exposes sensitive data, allowing attackers to gain access to critical PPTP and L2TP VPN credentials. This can potentially lead to unauthorized access to VPN services and compromise network security. It is essential for users of this version to implement mitigations promptly.

Affected Version(s)

NR255-V 1.5.130703

References

https://github.com/draw-ctf/netcore-router-public-refs/bl...
third-party-advisory
https://www.vulncheck.com/advisories/netcore-nr255-v-1.5....
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhou Ao
Yin Luxing
Jiang Yuxuan
Liu Xin
@Nebusec
.