CVE-2026-76865 Overview
CVE-2026-76865 is a null pointer dereference vulnerability [CWE-476] in the Netcore NR255-V router, version 1.5.130703. The flaw exists in two Quality of Service (QoS) setter Common Gateway Interface (CGI) handlers: filter_conn_del_cgi.c and gre_prio_set_cgi.c. Both handlers pass user-supplied input to atoi() without validating the result, allowing an authenticated attacker to trigger a null dereference by submitting crafted parameters. Successful exploitation crashes the affected process and produces a denial of service condition on the router.
Critical Impact
An authenticated attacker on the network can crash QoS handling on the Netcore NR255-V router, disrupting availability of network services managed by the device.
Affected Products
- Netcore NR255-V router, firmware version 1.5.130703
- QoS setter handler filter_conn_del_cgi.c
- QoS setter handler gre_prio_set_cgi.c
Discovery Timeline
- 2026-09-15 - CVE-2026-76865 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-76865
Vulnerability Analysis
The vulnerability affects two CGI handlers in the Netcore NR255-V firmware that process QoS configuration requests. Both handlers convert HTTP request parameters to integers using the C standard library atoi() function. Neither handler verifies that the source string exists before invoking the conversion, and neither validates the numeric result before using it as an index or pointer offset.
An attacker with authenticated access to the router's management interface can submit a request that omits or malforms the expected QoS parameters. The handler subsequently dereferences a null pointer derived from the unchecked conversion, terminating the CGI process. Repeated exploitation prevents legitimate administrators from applying QoS rules and can disrupt dependent services on the device.
Root Cause
The root cause is missing input validation around calls to atoi() in filter_conn_del_cgi.c and gre_prio_set_cgi.c. The atoi() function returns 0 on failure and provides no mechanism to distinguish invalid input from a legitimate zero value. The handlers assume the parameter is present and numeric, then use the returned value to index into structures without bounds checking, producing a null dereference.
Attack Vector
Exploitation requires network access to the router's web management interface and valid administrative credentials. An attacker crafts an HTTP request to either affected CGI endpoint with missing, empty, or non-numeric QoS parameters. The router process handling the request dereferences a null pointer and crashes, denying QoS configuration functionality until the service or device restarts.
Refer to the GitHub Null Dereference Analysis and the VulnCheck Security Advisory for the full technical breakdown.
Detection Methods for CVE-2026-76865
Indicators of Compromise
- Unexpected crashes or restarts of QoS-related CGI processes on the Netcore NR255-V router.
- HTTP requests targeting filter_conn_del_cgi or gre_prio_set_cgi endpoints with missing or non-numeric parameters.
- Repeated administrative session activity followed by loss of QoS enforcement on the device.
Detection Strategies
- Inspect router logs for CGI handler faults, segmentation faults, or watchdog-triggered service restarts tied to QoS components.
- Monitor authenticated web sessions for malformed POST or GET requests to the affected handlers.
- Correlate router availability alerts with recent administrative logins to identify potential abuse of valid credentials.
Monitoring Recommendations
- Forward router syslog output to a centralized logging platform and alert on CGI process crashes.
- Restrict management interface exposure and monitor authentication attempts against the router web UI.
- Track configuration changes to QoS rules and flag anomalies that follow crash events.
How to Mitigate CVE-2026-76865
Immediate Actions Required
- Restrict access to the router management interface to trusted administrative networks only.
- Rotate administrative credentials and enforce strong, unique passwords on the device.
- Disable remote management on the WAN interface if it is not required for operations.
- Monitor vendor channels for a firmware update addressing the affected CGI handlers.
Patch Information
At the time of NVD publication on 2026-09-15, no vendor patch is referenced in the advisory metadata. Administrators should consult Netcore for firmware updates that add input validation to filter_conn_del_cgi.c and gre_prio_set_cgi.c, and apply any released firmware promptly.
Workarounds
- Block external access to the CGI endpoints filter_conn_del_cgi and gre_prio_set_cgi at an upstream firewall.
- Limit administrative access to the router using access control lists that permit only known management hosts.
- Replace the affected device with a supported model if a firmware fix is not available and the router is deployed in a sensitive environment.
# Configuration example: restrict router management interface access
# Replace 10.0.0.0/24 with your administrative subnet and 192.0.2.10 with the router IP
iptables -A FORWARD -s 10.0.0.0/24 -d 192.0.2.10 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
