Out-of-Bounds Read Vulnerability in Netcore NR255-V Router
CVE-2026-92255

5.3MEDIUM

Key Information:

Vendor

Netcore

Status
Nr255-v
Vendor
CVE Published:
15 September 2026

What is CVE-2026-92255?

The Netcore NR255-V router version 1.5.130703 contains a critical flaw in its filter_arp_put_file.cgi, where improper string handling could lead to an out-of-bounds read. This vulnerability allows attackers to exploit the unterminated buffer, potentially revealing sensitive data stored in adjacent memory allocations. Proper mitigations and patches are essential to prevent unauthorized access and ensure network integrity.

Affected Version(s)

NR255-V 1.5.130703

References

https://github.com/draw-ctf/netcore-router-public-refs/bl...
third-party-advisory
https://www.vulncheck.com/advisories/netcore-nr255-v-1.5....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhou Ao
Yin Luxing
Jiang Yuxuan
Liu Xin
@Nebusec
.