CVE-2026-76867: Netcore NR255-V XSS Vulnerability

CVE-2026-76867 Overview

CVE-2026-76867 is a stored cross-site scripting [CWE-79] vulnerability in Netcore NR255-V firmware version 1.5.130703. The flaw resides in routing and Network Address Translation (NAT) configuration Common Gateway Interface (CGI) components: routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, and route_policy_parame_show_cgi. Authenticated attackers can inject persistent script payloads through the router's route and NAT configuration pages. The payloads execute in the browser context of any user who later views the affected administrative pages.

Critical Impact

Persistent JavaScript stored in router configuration executes against administrators, enabling session theft, configuration tampering, and further attacks on the management interface.

Affected Products

• Netcore NR255-V router
• Firmware version 1.5.130703
• Route and NAT configuration CGI handlers (routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, route_policy_parame_show_cgi)

Discovery Timeline

• 2026-09-15 - CVE-2026-76867 published to the National Vulnerability Database (NVD)
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-76867

Vulnerability Analysis

The Netcore NR255-V web management interface exposes multiple CGI endpoints that accept user-supplied values for route table entries and policy-based routing rules. These endpoints fail to sanitize or encode input before persisting it in device configuration. When an administrator later loads the routing or NAT view pages, the stored payload renders as executable script within the management UI.

Because the payload persists in the router's configuration store, exploitation does not require the attacker to remain online. Any subsequent visit by an authenticated administrator triggers the injected code. The attack requires low privileges to submit the malicious configuration and user interaction to view the affected page.

Root Cause

The root cause is missing output encoding and input validation in the affected CGI handlers. Route names, destination fields, and policy parameters are stored verbatim and reflected into HTML contexts without HTML entity encoding. This is a classic instance of improper neutralization of input during web page generation [CWE-79].

Attack Vector

Exploitation follows a typical stored XSS chain against embedded device management interfaces:

1. An attacker with low-privilege access to the router web UI submits a new route or NAT policy containing a JavaScript payload in an editable field processed by routing_tab_add_cgi or route_policy_add_cgi.
2. The payload is written to persistent configuration storage.
3. When an administrator opens the routing table view (routing_table_list_show_cgi) or the route policy view (route_policy_parame_show_cgi), the browser parses and executes the stored script.
4. The script runs with the administrator's session, allowing credential theft, forced configuration changes, or pivoting into the internal network.

No verified public exploit code is available. Refer to the GitHub stored XSS report and the VulnCheck advisory for technical details.

Detection Methods for CVE-2026-76867

Indicators of Compromise

• Route table or policy entries containing HTML tags, <script> fragments, javascript: URIs, or event handler attributes such as onerror= and onload=.
• Unexpected outbound requests from administrator browsers immediately after loading the router routing or NAT pages.
• New or modified administrator accounts, DNS settings, or firewall rules created shortly after admin sessions.

Detection Strategies

• Periodically export router configuration and grep route and NAT tables for HTML metacharacters and script keywords.
• Inspect HTTP responses from routing_table_list_show_cgi and route_policy_parame_show_cgi for reflected untrusted markup.
• Monitor administrative web sessions for anomalous XMLHttpRequest or fetch traffic that would indicate injected script activity.

Monitoring Recommendations

• Log all writes to route and NAT configuration CGI endpoints, including the submitting source IP and user account.
• Alert on router configuration diffs that introduce non-alphanumeric characters into route description or policy fields.
• Restrict management interface access to a dedicated administrative VLAN and log all connections to it.

How to Mitigate CVE-2026-76867

Immediate Actions Required

• Restrict access to the NR255-V web management interface to trusted administrative hosts only; disable any WAN-side management exposure.
• Audit existing route and NAT policy entries and remove any values containing HTML or script content.
• Rotate router administrator credentials and invalidate active management sessions after clean-up.
• Require administrators to use a dedicated browser profile with no saved credentials when managing the device.

Patch Information

No vendor patch is referenced in the NVD entry or the linked advisories at the time of publication. Monitor Netcore for firmware updates superseding version 1.5.130703 and review the VulnCheck advisory for updated remediation guidance.

Workarounds

• Limit router administrative accounts to a minimum number of trusted users to reduce the pool of low-privileged submitters.
• Access the management UI only from an isolated browser or virtual machine that cannot reach sensitive internal resources.
• Consider replacing the device if it is deployed in security-sensitive segments and no firmware fix becomes available.