CVE-2026-76863: Netcore NR255-V Information Disclosure Flaw

CVE-2026-76863 Overview

CVE-2026-76863 is a sensitive information disclosure vulnerability affecting Netcore NR255-V routers running firmware version 1.5.130703. The flaw resides in the mod_qos_bandwidthplan.json handling logic within filter_conns_dump_cgi.c and IGD_CgiCall.c. Authenticated users with broadly assigned roles can invoke the Quality of Service (QoS) read routes to retrieve live network telemetry. The exposed data exceeds the privilege level intended for lower-tier accounts, breaking the authorization model defined for the device. The issue is classified under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated low-privilege users can extract live QoS bandwidth telemetry and connection metadata from the router, exposing network activity patterns to unauthorized principals.

Affected Products

Netcore NR255-V router
Firmware version 1.5.130703
mod_qos_bandwidth module (plan.json handler)

Discovery Timeline

2026-09-15 - CVE-2026-76863 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-76863

Vulnerability Analysis

The vulnerability lives in the router's QoS bandwidth subsystem, which exposes JSON endpoints that summarize per-connection traffic statistics. The handlers implemented in filter_conns_dump_cgi.c and IGD_CgiCall.c authenticate requests but fail to enforce granular role checks before returning plan.json content. As a result, any authenticated session, including accounts intended for constrained management tasks, can query the QoS routes and receive live telemetry. The telemetry includes connection identifiers, bandwidth measurements, and traffic classification data useful to an attacker profiling internal hosts.

Root Cause

The root cause is missing authorization enforcement on QoS read routes. The CGI code validates session existence but does not verify that the authenticated principal holds the QoS-view role before returning plan.json. This maps directly to CWE-863: Incorrect Authorization. The flaw is a broken access control issue rather than a memory-safety defect, and it stems from a design gap in how mod_qos_bandwidth routes trust the session layer.

Attack Vector

An attacker requires valid credentials on the device, but the required privilege is low. Once authenticated, the attacker issues HTTP GET requests to the QoS plan.json endpoints exposed by filter_conns_dump_cgi.c and IGD_CgiCall.c. The server returns telemetry that would normally be restricted to administrators. No user interaction is required, and the attack executes over the network path used for normal router management. For the disclosure write-up, see the GitHub disclosure analysis and the VulnCheck advisory.

No verified proof-of-concept code has been published for this issue. The vulnerable mechanism is limited to unauthorized reads of the QoS plan.json routes; refer to the linked references for endpoint specifics.

Detection Methods for CVE-2026-76863

Indicators of Compromise

Unexpected HTTP GET requests to QoS plan.json routes originating from non-administrator sessions.
Repeated authenticated polling of filter_conns_dump or IGD_CgiCall endpoints from a single low-privilege account.
Router access logs showing telemetry queries from IP addresses not associated with network operators.

Detection Strategies

Correlate router web-management logs with account role assignments to flag QoS reads by non-admin roles.
Deploy network monitoring rules that alert on high-frequency plan.json requests to the Netcore NR255-V management interface.
Ingest router syslog into a centralized data lake and hunt for QoS route access patterns inconsistent with staff activity.

Monitoring Recommendations

Enable verbose HTTP logging on the router and forward logs to a SIEM for retention and analysis.
Baseline normal administrative traffic to the management interface and alert on deviations by user or source IP.
Track authentication events for low-privilege accounts and pair them with subsequent CGI route access.

How to Mitigate CVE-2026-76863

Immediate Actions Required

Restrict management interface access to trusted administrative networks using firewall rules or ACLs.
Audit existing user accounts on the NR255-V and remove or downgrade accounts that do not require QoS visibility.
Rotate credentials for all router accounts and enforce strong, unique passwords.
Monitor the VulnCheck advisory for vendor patch availability.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-76863. Administrators should track the VulnCheck advisory and Netcore vendor channels for firmware updates addressing the mod_qos_bandwidth authorization gap.

Workarounds

Block external access to the router's HTTP management interface at the perimeter.
Limit the number of authenticated accounts on the device and enforce least-privilege role assignments.
Segment the router's management VLAN from general user networks to reduce exposure of authenticated sessions.
Disable the QoS management feature if it is not required in the deployment.

bash

# Example: restrict router management access to a trusted admin subnet
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP