Stored Cross-Site Scripting in Netcore NR255-V by Netcore
CVE-2026-76872

5.1MEDIUM

Key Information:

Vendor

Netcore

Status
Nr255-v
Vendor
CVE Published:
15 September 2026

What is CVE-2026-76872?

The Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability that can be exploited through the DHCP static IP and IP ACL management pages. Specifically, components such as dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi are vulnerable, allowing attackers to inject persistent malicious scripts. These scripts can compromise the web management interface, leading to unauthorized access and data manipulation for other users interacting with the affected system.

Affected Version(s)

NR255-V 1.5.130703

References

https://github.com/draw-ctf/netcore-router-public-refs/bl...
third-party-advisory
https://www.vulncheck.com/advisories/netcore-nr255-v-1.5....
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhou Ao
Yin Luxing
Jiang Yuxuan
Liu Xin
@Nebusec
.