CVE-2026-76858: Netcore NR255-V Stored XSS Vulnerability

CVE-2026-76858 Overview

CVE-2026-76858 is a stored cross-site scripting (XSS) vulnerability affecting the Netcore NR255-V router running firmware version 1.5.130703. The flaw resides in the ddns_wan_list_show.cgi endpoint, which unsafely passes Dynamic DNS (DDNS) configuration data into a JavaScript eval() call. An authenticated attacker with high privileges can inject malicious script through the DDNS configuration path. The payload persists in the router configuration and executes each time an administrator views the affected page. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Persistent script execution in the router's administrative interface enables session hijacking, configuration tampering, and pivoting to internal network resources.

Affected Products

Netcore NR255-V router
Firmware version 1.5.130703
Web management component ddns_wan_list_show.cgi

Discovery Timeline

2026-09-15 - CVE-2026-76858 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-76858

Vulnerability Analysis

The vulnerability originates in the router's DDNS handling logic. The ddns_wan_list_show.cgi script renders stored DDNS configuration entries into the administrative page by passing values through JavaScript eval() without sanitization or output encoding. Because attacker-controlled DDNS data flows directly into a script execution sink, any injected payload becomes executable JavaScript in the administrator's browser session.

Exploitation requires authenticated access with high privileges and some user interaction, which limits opportunistic attacks. However, the persistent nature of the injection means the payload survives across sessions and reboots. A malicious script executing in the router UI runs with full administrative context, allowing an attacker to modify router settings, exfiltrate credentials cached in the browser, or issue additional CGI requests on behalf of the victim.

Root Cause

The root cause is unsafe use of the JavaScript eval() function on untrusted DDNS data. The CGI handler serializes stored configuration values into an inline script block without escaping quotes, angle brackets, or other JavaScript-significant characters. When the browser parses the response, the injected content is interpreted as code rather than data.

Attack Vector

An attacker with administrative credentials submits a crafted DDNS hostname or related field containing JavaScript syntax through the router's DDNS configuration interface. The malicious value is stored in the device configuration. When any administrator subsequently loads ddns_wan_list_show.cgi, the payload executes in their browser under the router management origin.

Technical details are documented in the GitHub Stored XSS Report and the VulnCheck Security Advisory.

Detection Methods for CVE-2026-76858

Indicators of Compromise

DDNS configuration entries containing JavaScript syntax such as <script>, javascript:, or backtick-wrapped expressions
Unexpected outbound HTTP requests originating from administrator sessions after visiting the router UI
Modifications to router configuration that were not initiated by legitimate administrators
Browser console errors or unusual script execution warnings on ddns_wan_list_show.cgi

Detection Strategies

Inspect stored DDNS configuration values on affected NR255-V devices for characters that should not appear in valid hostnames
Review HTTP access logs on the router for POST requests to DDNS configuration endpoints from unexpected source addresses
Correlate administrator browser telemetry with router management sessions to identify anomalous script execution

Monitoring Recommendations

Monitor network traffic to router management interfaces and alert on access from non-administrative subnets
Track configuration changes on edge devices using centralized logging and flag deviations from baseline
Enable browser-side content security monitoring for personnel who administer network equipment

How to Mitigate CVE-2026-76858

Immediate Actions Required

Restrict access to the NR255-V administrative interface to trusted management networks only
Audit existing DDNS configuration entries and remove any values containing script syntax or unexpected characters
Rotate administrative credentials on affected devices and enforce strong, unique passwords
Avoid accessing the router UI from browsers used for general web activity to reduce cross-origin exposure

Patch Information

No vendor patch has been referenced in the published advisory. Consult the VulnCheck Security Advisory and Netcore vendor channels for firmware updates addressing firmware version 1.5.130703.

Workarounds

Disable the DDNS feature on the router if it is not required for operations
Place the router management interface behind a jump host or VPN and block direct LAN access
Use a dedicated, isolated browser profile for router administration to contain XSS execution
Consider replacing end-of-support consumer routers with actively maintained equipment where feasible

bash

# Example: restrict router management access with an upstream firewall rule
# Only allow the management workstation (192.0.2.10) to reach the router UI
iptables -A FORWARD -s 192.0.2.10 -d <router_ip> -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d <router_ip> -p tcp --dport 80 -j DROP