CVE-2026-76870 Overview
CVE-2026-76870 is an out-of-bounds read vulnerability in Netcore NR255-V firmware version 1.5.130703. The flaw exists in the mtd_write pre-flash validation routine and is triggered by short firmware uploads. Attackers with low-privileged network access can upload a truncated firmware image through put_file_cgi.c, causing out-of-bounds reads across main.c, check_image_uuid.c, and oemMD5Update.c. The weakness is classified as [CWE-125] Out-of-bounds Read.
Critical Impact
Authenticated attackers on the network can trigger memory disclosure and denial of service on affected Netcore NR255-V routers by submitting truncated firmware images to the upload endpoint.
Affected Products
- Netcore NR255-V router
- Firmware version 1.5.130703
- mtd_write firmware validation routine invoked by put_file_cgi.c
Discovery Timeline
- 2026-09-15 - CVE-2026-76870 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-76870
Vulnerability Analysis
The vulnerability resides in the pre-flash validation logic that runs before firmware is committed to MTD (Memory Technology Device) flash storage. When the router receives a firmware upload through the put_file_cgi.c handler, downstream code parses metadata structures without confirming that the uploaded payload contains enough bytes to satisfy those structures.
A truncated firmware image causes the parser to read past the end of the buffer. The affected routines include image parsing in main.c, UUID verification in check_image_uuid.c, and MD5 processing in oemMD5Update.c. Reads outside the allocated buffer can leak adjacent memory contents or crash the validation process, disrupting router availability.
The attack is remotely reachable and requires only low privileges, matching the network attack surface exposed by the router's web management interface.
Root Cause
The root cause is missing length validation between the uploaded firmware size and the fixed-size header structures the validator dereferences. The mtd_write routine assumes minimum image size guarantees that never occur for short uploads, and its callers pass buffer pointers without corresponding length checks.
Attack Vector
An authenticated attacker sends an HTTP request to the firmware upload CGI endpoint with a firmware payload smaller than the header structures expected by the validator. The validator reads header fields, UUID data, and MD5 update blocks beyond the buffer boundary, producing out-of-bounds reads that can be observed as crashes or reflected data in error paths.
See the GitHub firmware upload PoC and the VulnCheck advisory for Netcore NR255 for full technical details. No verified exploit code is reproduced here.
Detection Methods for CVE-2026-76870
Indicators of Compromise
- HTTP POST requests to the firmware upload CGI endpoint (put_file_cgi) with Content-Length values smaller than a legitimate firmware image.
- Unexpected reboots, watchdog resets, or crash logs referencing mtd_write, check_image_uuid, or oemMD5Update.
- Repeated firmware upload attempts from a single source over a short interval.
Detection Strategies
- Inspect web server and CGI logs on the router for firmware upload requests that do not correspond to scheduled maintenance windows.
- Alert on management-plane authentication events followed by firmware upload activity from non-administrator source addresses.
- Correlate router crash telemetry with preceding HTTP upload requests to identify triggering payloads.
Monitoring Recommendations
- Restrict and monitor access to router management interfaces from the LAN and WAN segments.
- Forward router syslog and authentication events to a central logging platform for retention and analysis.
- Track firmware version and integrity across the fleet to detect unexpected changes or repeated upload attempts.
How to Mitigate CVE-2026-76870
Immediate Actions Required
- Remove exposure of the router web management interface from untrusted networks, including the internet.
- Rotate administrative credentials for the router to reduce the risk of low-privilege abuse.
- Restrict firmware upload functionality to trusted management workstations using network access controls.
Patch Information
No vendor advisory or patched firmware version is referenced in the CVE data at the time of publication. Consult the VulnCheck advisory for updates on vendor remediation for firmware 1.5.130703.
Workarounds
- Disable remote administration on the WAN interface and permit management traffic only from an internal, trusted VLAN.
- Place affected NR255-V devices behind a firewall that filters HTTP requests to the firmware upload CGI path.
- Require multifactor or bastion-host access for any administrator authorized to upload firmware.
# Configuration example: restrict management access with iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 80 -s <MGMT_SUBNET> -j ACCEPT
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 443 -s <MGMT_SUBNET> -j ACCEPT
iptables -A FORWARD -p tcp -d <ROUTER_IP> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
