CVE-2026-76864 Overview
CVE-2026-76864 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Netcore NR255-V routers running firmware version 1.5.130703. The affected device fails to sanitize Quality of Service (QoS) rule names before passing them to eval() inside the qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi handlers. An authenticated attacker can inject persistent script code through crafted QoS rule name input. The script executes when the stored data is later processed by the affected handlers, targeting any administrator who views the QoS configuration.
Critical Impact
Authenticated attackers can persist attacker-controlled JavaScript in the router administration interface, enabling session hijack and configuration tampering against administrators.
Affected Products
- Netcore NR255-V router firmware version 1.5.130703
- QoS CGI handlers: qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, qos_filter_show_cgi
- Web administration interface exposed on the LAN
Discovery Timeline
- 2026-09-15 - CVE-2026-76864 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-76864
Vulnerability Analysis
The NR255-V web management interface stores user-supplied QoS rule names and later parses them through JavaScript eval() in four CGI handlers. Because rule names are never HTML-escaped or JavaScript-encoded, an attacker can embed a payload directly inside the stored configuration. When an administrator loads a page served by qos_xianz_show_cgi or qos_filter_show_cgi, the browser executes the injected script in the context of the authenticated admin session.
The issue combines two weaknesses: unsafe reflection of untrusted input into a script sink (eval()) and missing output encoding. Attackers gain the ability to read authenticated pages, exfiltrate session tokens, alter routing or firewall settings, and pivot deeper into the LAN.
Root Cause
The root cause is missing input sanitization and unsafe use of eval() on attacker-controllable strings. QoS rule names are stored verbatim in NVRAM and interpolated into JavaScript emitted by the *_show_cgi handlers. Neither the add path nor the show path applies context-aware encoding before the value reaches the script parser.
Attack Vector
Exploitation requires authenticated administrative access to submit a QoS rule containing a JavaScript payload as the rule name. Once stored, the payload executes for any user who subsequently opens the QoS configuration page. User interaction is required to trigger the stored payload. Full technical details are documented in the GitHub XSS Vulnerability Report and the VulnCheck Advisory.
No verified public proof-of-concept code is available. See the referenced advisories for payload structure and reproduction steps.
Detection Methods for CVE-2026-76864
Indicators of Compromise
- QoS rule names containing HTML tags, <script> fragments, or JavaScript operators such as );, backticks, or event handlers like onerror=.
- Unexpected QoS rules created outside change-management windows.
- Administrator browser sessions issuing anomalous requests to router CGI endpoints immediately after loading QoS pages.
Detection Strategies
- Inspect stored router configuration exports for non-alphanumeric characters in QoS rule name fields.
- Monitor administrative HTTP traffic to qos_xianz_add_cgi and qos_filter_add_cgi for payloads containing script metacharacters.
- Compare running configurations against known-good baselines to identify rule name tampering.
Monitoring Recommendations
- Log and alert on all authenticated changes to router QoS configuration.
- Capture outbound requests from administrator workstations to the router web interface for anomaly review.
- Track firmware version inventory and flag any device on 1.5.130703 until remediated.
How to Mitigate CVE-2026-76864
Immediate Actions Required
- Restrict router administrative access to a dedicated management VLAN or trusted host list.
- Require administrators to use isolated browser profiles when accessing the NR255-V web UI.
- Audit existing QoS rules and remove any rule names containing script metacharacters.
- Rotate administrator credentials if unauthorized QoS rule modifications are found.
Patch Information
No vendor patch is referenced in the NVD entry or linked advisories at the time of publication. Consult Netcore directly for firmware updates superseding version 1.5.130703 and monitor the VulnCheck Advisory for updates.
Workarounds
- Disable remote administration and limit web UI exposure to wired LAN interfaces only.
- Enforce strong, unique administrator credentials to reduce the risk of unauthorized QoS changes.
- Avoid editing or viewing QoS rules from browsers that hold other privileged sessions.
- Consider replacing the device if the vendor does not publish a fixed firmware release.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
