CVE-2026-76855 Overview
CVE-2026-76855 is a sensitive information disclosure vulnerability affecting Netcore NR255-V routers running firmware version 1.5.130703. The flaw resides in audit endpoints handled by l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and mod_dispatch_auth/plan.json. Authenticated attackers can query these audit components to retrieve session and browsing history data belonging to other users. The weakness is classified under [CWE-359: Exposure of Private Personal Information to an Unauthorized Actor]. The vulnerability allows cross-session data leakage without requiring administrative privileges or user interaction.
Critical Impact
Low-privileged network attackers can extract other users' session tokens and browsing history from the router's audit endpoints, enabling account takeover and privacy compromise.
Affected Products
- Netcore NR255-V router, firmware version 1.5.130703
- Audit endpoint handlers: l7_web_auth_log_dump_cgi.c and audit_get_cgi.c
- Dispatch module component mod_dispatch_auth/plan.json
Discovery Timeline
- 2026-09-15 - CVE-2026-76855 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-76855
Vulnerability Analysis
The Netcore NR255-V exposes several audit endpoints intended to record authentication events and browsing activity for administrative review. These endpoints fail to enforce per-user access controls when returning stored audit records. Any authenticated session on the device can query the endpoints and receive audit entries generated by other users. The disclosed data includes session identifiers and URL history collected across concurrent sessions. This gives attackers material sufficient to hijack active sessions and profile user behavior on the local network. See the VulnCheck Security Advisory for the full technical breakdown.
Root Cause
The root cause is missing authorization checks on audit data retrieval. The handlers in l7_web_auth_log_dump_cgi.c and audit_get_cgi.c do not scope returned records to the requesting session's identity. The dispatch route defined in mod_dispatch_auth/plan.json permits any authenticated caller to invoke these handlers. As a result, audit logs designed for privileged review are returned to any low-privileged caller.
Attack Vector
An attacker with a low-privilege account on the router LAN or management interface sends HTTP requests to the audit endpoints. The router responds with cross-user audit content including captured session identifiers and browsed URLs. The attacker replays harvested session tokens to impersonate other users or maps browsing history for reconnaissance. No user interaction is required, and the attack completes over the network. Technical proof-of-concept steps are documented in the GitHub Audit Report.
No verified exploit code is publicly available at this time. Refer to the linked advisory for endpoint URIs and request structure.
Detection Methods for CVE-2026-76855
Indicators of Compromise
- Repeated HTTP GET requests from a single client to l7_web_auth_log_dump_cgi, audit_get_cgi, or paths referencing mod_dispatch_auth/plan.json.
- Audit endpoint responses containing session identifiers or URL history not originating from the requesting user.
- Session tokens observed in use from IP addresses that differ from the token's issuing client.
Detection Strategies
- Enable and centralize HTTP access logs from the router management plane, then alert on any successful invocation of the affected CGI handlers by non-administrative accounts.
- Correlate authentication events with session-token usage to identify replayed identifiers appearing from unexpected sources.
- Baseline normal audit endpoint access frequency and flag deviations from that baseline.
Monitoring Recommendations
- Forward router access and authentication logs to a centralized SIEM or data lake for retention and correlation.
- Monitor LAN traffic for repeated polling of audit endpoints from workstation IP ranges.
- Track new-device logins that follow closely after audit endpoint queries as a signal of session reuse.
How to Mitigate CVE-2026-76855
Immediate Actions Required
- Restrict access to the router's management interface to trusted administrative hosts only, blocking LAN-side clients from reaching the CGI endpoints.
- Rotate all local user credentials and invalidate active sessions on affected NR255-V devices.
- Disable remote management on the WAN interface until a vendor patch is available.
Patch Information
At the time of publication, Netcore has not released a firmware update addressing CVE-2026-76855. Monitor the VulnCheck Security Advisory and Netcore vendor channels for firmware releases superseding version 1.5.130703.
Workarounds
- Place the router management interface behind a network ACL that permits only administrator workstations.
- Segment guest and untrusted user networks away from the router management VLAN.
- Require unique per-user accounts and shorten session lifetimes to reduce the value of leaked session tokens.
# Example ACL to restrict management access to a single admin host
iptables -A INPUT -i br-lan -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -i br-lan -p tcp --dport 80 -j DROP
iptables -A INPUT -i br-lan -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -i br-lan -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
