CVE-2026-76860: Netcore NR255-V Buffer Overflow Vulnerability

CVE-2026-76860 Overview

CVE-2026-76860 is a stack-based buffer overflow [CWE-121] in the Netcore NR255-V router, version 1.5.130703. The flaw resides in the wake_up_set.cgi endpoint, which performs unbounded tokenization of attacker-supplied MAC and ID parameters. Supplying oversized values corrupts adjacent stack memory and can subvert program control flow. The vulnerability is network-accessible and requires low privileges, exposing the confidentiality, integrity, and availability of affected devices.

Critical Impact
Authenticated network attackers can overflow the stack buffer in wake_up_set.cgi and corrupt program memory on affected Netcore NR255-V routers, enabling potential arbitrary code execution on the device.

Affected Products

Netcore NR255-V router firmware version 1.5.130703
The wake_up_set.cgi handler in the router's web management interface
Deployments exposing the router web UI on LAN or WAN interfaces

Discovery Timeline

2026-09-15 - CVE-2026-76860 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-76860

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow [CWE-121] in the wake_up_set.cgi handler used to configure Wake-on-LAN behavior. The handler accepts MAC and ID parameters from HTTP requests and tokenizes them without validating input length against the destination stack buffer size.

Because the tokenization routine copies caller-controlled bytes into a fixed-size stack allocation, oversized MAC or ID fields overwrite adjacent stack data. This includes saved registers, return addresses, and local variables, producing deterministic memory corruption. On embedded MIPS or ARM firmware without modern stack protections, this pattern commonly enables arbitrary code execution.

Root Cause

The root cause is missing bounds enforcement during input tokenization. The CGI handler treats the MAC and ID values as trusted-length strings and copies each token into a stack buffer using unbounded string routines. No length check, delimiter cap, or destination boundary is applied before the copy.

Attack Vector

An attacker with low-privileged network access to the router's web management interface issues a crafted HTTP request to wake_up_set.cgi containing oversized MAC and ID parameters. The tokenizer walks the input and writes past the fixed stack buffer, overwriting the saved return address on the stack frame.

Refer to the GitHub Wake Up Set Overflow Analysis and the VulnCheck Advisory on Buffer Overflow for the technical reverse engineering write-up, including offset calculations for the vulnerable buffer.

Detection Methods for CVE-2026-76860

Indicators of Compromise

HTTP POST or GET requests to /wake_up_set.cgi containing abnormally long MAC or ID parameter values
Router web service crashes, unexpected reboots, or httpd process restarts following inbound HTTP traffic
Outbound connections from the router to unfamiliar hosts, indicating post-exploitation staging
Configuration changes or new administrative sessions not initiated by legitimate operators

Detection Strategies

Inspect web server access logs for requests to wake_up_set.cgi where the MAC or ID parameter exceeds expected formats (12 hex characters for MAC, short numeric or alphanumeric for ID)
Deploy network intrusion detection signatures that flag oversized query strings or POST bodies targeting the wake_up_set.cgi endpoint
Correlate HTTP requests to the vulnerable endpoint with subsequent router availability events and process restarts

Monitoring Recommendations

Restrict and monitor administrative access to the router web interface; alert on authentications from unexpected source addresses
Baseline normal router process behavior and alert on anomalous outbound traffic patterns originating from the device
Forward router syslog data to a centralized logging platform for retention and correlation with network telemetry

How to Mitigate CVE-2026-76860

Immediate Actions Required

Disable remote WAN access to the router's web management interface and restrict LAN access to trusted management subnets only
Rotate administrative credentials for the router and any accounts shared with adjacent devices
Segment vulnerable NR255-V units on isolated VLANs until vendor firmware remediation is available
Monitor the VulnCheck Advisory on Buffer Overflow for updated vendor fix information

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-76860. Administrators should track Netcore vendor channels and the linked advisories for firmware releases addressing the wake_up_set.cgi tokenization flaw. Until a fix is available, apply the network-layer mitigations described below.

Workarounds

Block HTTP requests to the /wake_up_set.cgi path at an upstream firewall or reverse proxy when the Wake-on-LAN feature is not required
Enforce web application firewall rules that reject requests where the MAC parameter is not a valid 12-character hexadecimal MAC address or where the ID parameter exceeds expected length
Disable the Wake-on-LAN feature through the router configuration if operationally acceptable
Place the router behind a network access control layer that limits management-plane exposure to a jump host

bash

# Example upstream firewall rule to block requests to the vulnerable endpoint
# (adapt syntax to your network device or WAF)
iptables -A FORWARD -p tcp --dport 80 -m string \
  --algo bm --string "/wake_up_set.cgi" -j DROP