CVE-2026-76854 Overview
CVE-2026-76854 is a sensitive information disclosure vulnerability in the Netcore NR255-V router running firmware version 1.5.130703. The flaw resides in the l7_web_auth_user_show.cgi component, which handles captive-portal user credential display. An authenticated attacker with low privileges can query this Common Gateway Interface (CGI) endpoint and retrieve captive-portal user credentials in cleartext. This exposure compromises the confidentiality of authenticated network access and enables lateral movement against users of the captive portal. The weakness is classified under CWE-522: Insufficiently Protected Credentials.
Critical Impact
Attackers with network access and low-level authentication can extract captive-portal credentials from the router, enabling unauthorized network access and identity abuse against portal-authenticated users.
Affected Products
- Netcore NR255-V router
- Firmware version 1.5.130703
- Component: l7_web_auth_user_show.cgi (captive-portal user display CGI)
Discovery Timeline
- 2026-09-15 - CVE-2026-76854 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-76854
Vulnerability Analysis
The Netcore NR255-V exposes the l7_web_auth_user_show.cgi endpoint as part of its Layer 7 web authentication management interface. This CGI returns captive-portal user records, including credentials, without adequately restricting who may read them. An attacker who reaches the router's management interface and holds low-privilege credentials can request the endpoint and receive credential material intended only for privileged administrators.
Captive-portal credentials often overlap with corporate or Wi-Fi identities, so disclosure extends beyond the router. Attackers can reuse the harvested credentials to impersonate legitimate users on the network, bypass access controls, and pivot to internal services. Because the router serves as a network access gateway, credential theft undermines the trust boundary the portal was designed to enforce.
Root Cause
The root cause is insufficiently protected credentials [CWE-522]. The l7_web_auth_user_show.cgi handler returns stored captive-portal credentials to callers that should not be authorized to view them. The endpoint lacks proper authorization checks and stores or returns credentials in a form recoverable by the requester, violating least-privilege principles for credential storage.
Attack Vector
Exploitation requires network access to the router's management interface and low-privilege authentication. No user interaction is required. An attacker sends an HTTP request to the vulnerable CGI endpoint and parses the response to extract captive-portal usernames and passwords. Refer to the VulnCheck advisory and the public credential disclosure report for reproduction details.
No verified exploit code has been published. See the referenced advisories for technical reproduction steps.
Detection Methods for CVE-2026-76854
Indicators of Compromise
- HTTP requests to the path l7_web_auth_user_show.cgi on the router management interface from unexpected source addresses.
- Authenticated sessions from low-privilege router accounts issuing requests to administrative CGI endpoints.
- Subsequent captive-portal logins from geographies or devices inconsistent with the legitimate user's baseline.
Detection Strategies
- Inspect router and upstream proxy access logs for GET or POST requests targeting l7_web_auth_user_show.cgi outside of normal administrative windows.
- Correlate router management authentication events with subsequent captive-portal credential reuse to identify credential harvesting followed by lateral use.
- Alert on repeated captive-portal logins from a single client IP using multiple distinct user accounts within a short window.
Monitoring Recommendations
- Forward Netcore NR255-V syslog and HTTP access logs to a centralized log platform for retention and analysis.
- Monitor for unauthorized access attempts to Layer 7 authentication management endpoints and flag responses that contain credential-like fields.
- Track captive-portal account usage patterns and alert on anomalies such as impossible travel or off-hours authentication.
How to Mitigate CVE-2026-76854
Immediate Actions Required
- Restrict management-interface access to trusted administrative networks using access control lists or firewall rules.
- Rotate all captive-portal credentials stored on affected NR255-V devices under the assumption that they may already be exposed.
- Audit accounts on the router and remove unused or low-privilege accounts that could be leveraged to reach the vulnerable CGI.
Patch Information
No vendor patch is referenced in the available advisories at the time of publication. Consult the VulnCheck advisory for updates. Apply any firmware update from Netcore once released and validate that l7_web_auth_user_show.cgi no longer returns credentials to non-administrative accounts.
Workarounds
- Place the router management interface behind a VPN or dedicated management VLAN so it is not reachable from user network segments.
- Disable or block external HTTP access to l7_web_auth_user_show.cgi at an upstream reverse proxy or firewall until a patch is available.
- Enforce unique, strong captive-portal credentials that are not reused elsewhere to limit the blast radius if credentials are disclosed.
# Example firewall rule to restrict router management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
