CVE-2026-76856: Netcore NR255-V CSRF Vulnerability

CVE-2026-76856 Overview

CVE-2026-76856 is a cross-site request forgery (CSRF) vulnerability [CWE-352] in the Netcore NR255-V router running firmware version 1.5.130703. The flaw affects three administrative endpoints: wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi. An attacker who tricks an authenticated administrator into visiting a malicious page can silently submit forged requests that modify the router's WAN or LAN configuration. Successful exploitation allows adversaries to alter network settings without the administrator's knowledge or consent, disrupting connectivity and enabling downstream attacks against connected devices.

Critical Impact
Attackers can hijack administrator sessions to reconfigure WAN and LAN settings on the Netcore NR255-V router, potentially enabling traffic redirection, denial of service, and pivoting into the local network.

Affected Products

Netcore NR255-V router
Firmware version 1.5.130703
Administrative endpoints: wan_config_set_cgi, wan_num_set_cgi, lan_ip_change_cgi

Discovery Timeline

2026-09-15 - CVE-2026-76856 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in the NVD database

Technical Details for CVE-2026-76856

Vulnerability Analysis

The Netcore NR255-V web management interface exposes several CGI endpoints that accept state-changing requests from authenticated administrator sessions. These endpoints do not implement anti-CSRF protections such as unpredictable request tokens, origin validation, or SameSite cookie enforcement. As a result, the router accepts any well-formed HTTP request that carries a valid session cookie, regardless of where the request originated. An attacker who hosts or injects a crafted page on any site the administrator visits can submit background requests to the router. The requests execute with the administrator's authority and change network configuration.

Root Cause

The root cause is missing CSRF protection on privileged CGI endpoints. Each of the three affected handlers processes configuration mutations based solely on session authentication. The firmware does not verify the Origin or Referer headers, does not require a per-session CSRF token, and does not use restrictive cookie attributes. This design allows cross-origin form submissions or fetch requests to trigger sensitive actions.

Attack Vector

Exploitation requires an administrator to be authenticated to the router and to visit an attacker-controlled page in the same browser. The attacker page issues a hidden HTML form POST or JavaScript request to wan_config_set_cgi, wan_num_set_cgi, or lan_ip_change_cgi on the router's LAN address. The browser attaches the session cookie automatically. The router processes the request and applies the malicious configuration. Refer to the VulnCheck Advisory on CSRF and the GitHub CSRF Vulnerability Document for endpoint-level detail.

Detection Methods for CVE-2026-76856

Indicators of Compromise

Unexpected changes to WAN configuration parameters (ISP credentials, connection type, DNS servers) on the NR255-V.
Unplanned changes to the LAN IP subnet or gateway address that disrupt client connectivity.
Router administrator sessions producing configuration write requests immediately after browsing external websites.

Detection Strategies

Monitor HTTP access logs on the router or upstream proxy for POST requests to wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi originating from cross-origin Referer headers.
Alert on configuration change events that occur outside of scheduled maintenance windows or from unexpected client IP addresses.
Compare router configuration snapshots on a regular schedule and flag deltas in WAN or LAN parameters.

Monitoring Recommendations

Capture and centralize router administrative logs for correlation with endpoint browser activity.
Track DNS resolver settings pushed to LAN clients and alert when they change to unfamiliar upstream servers.
Watch for sudden loss of connectivity or subnet reassignments affecting management endpoints.

How to Mitigate CVE-2026-76856

Immediate Actions Required

Restrict access to the router administrative interface to a dedicated management workstation that is not used for general web browsing.
Log out of the router immediately after completing administrative tasks to invalidate the session cookie.
Change the default administrator credentials and restrict management access to the LAN interface only.

Patch Information

As of the NVD publication date, no vendor patch is referenced in the advisory. Consult Netcore for firmware updates addressing firmware version 1.5.130703. Review the VulnCheck Advisory on CSRF for updates on remediation guidance.

Workarounds

Use a dedicated browser profile or isolated browser instance solely for router administration to prevent shared session cookies with untrusted sites.
Configure the browser to block third-party cookies and enforce strict SameSite behavior where possible.
Place the router management interface behind an ACL that limits access to a specific administrative host.
Consider replacing the affected device if the vendor does not release a firmware update addressing the missing CSRF protections.

bash

# Configuration example: restrict router admin access via host firewall
# Allow only the designated admin workstation to reach the router web UI
iptables -A OUTPUT -d 192.168.1.1 -p tcp --dport 80 -m owner --uid-owner admin -j ACCEPT
iptables -A OUTPUT -d 192.168.1.1 -p tcp --dport 80 -j DROP