CVE-2026-76871: Netcore NR255-V Information Disclosure Flaw

CVE-2026-76871 Overview

CVE-2026-76871 is a sensitive information disclosure vulnerability in Netcore NR255-V version 1.5.130703. The flaw resides in four web handlers: mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi. Attackers with low-privilege access to the router interface can query these endpoints to retrieve stored Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Tunneling Protocol (L2TP) VPN credentials. The weakness maps to [CWE-522: Insufficiently Protected Credentials]. Exposure of these credentials enables lateral movement into the corporate networks reachable through the affected VPN tunnels.

Critical Impact
Authenticated attackers can extract cleartext PPTP and L2TP VPN credentials from the router, enabling unauthorized access to downstream corporate networks.

Affected Products

Netcore NR255-V router, firmware version 1.5.130703
VPN read handlers: mod_vpn_remote/plan.json, pptpd_user_show.cgi
VPN read handlers: pptp_client_config_show.cgi, l2tpd_user_show.cgi

Discovery Timeline

2026-09-15 - CVE-2026-76871 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-76871

Vulnerability Analysis

The Netcore NR255-V firmware exposes four Common Gateway Interface (CGI) endpoints that return VPN account material without adequate authorization or redaction. The pptpd_user_show.cgi and l2tpd_user_show.cgi handlers enumerate server-side PPTP and L2TP user records. The pptp_client_config_show.cgi handler discloses client-side VPN dial-out configuration. The mod_vpn_remote/plan.json resource returns structured VPN plan data consumed by the router user interface. Each handler returns credential fields in cleartext to the caller. An authenticated user of the router web console, including any low-privilege local account, can invoke these endpoints and harvest secrets that were never intended to leave the device.

Root Cause

The root cause is insufficient protection of stored credentials, tracked as [CWE-522]. The affected handlers serialize PPTP and L2TP account data, including passwords and pre-shared keys, into HTTP responses instead of masking them or restricting access to administrative sessions.

Attack Vector

Exploitation is performed over the network against the router management interface. The attacker authenticates with low-privilege credentials, then issues HTTP GET requests to the affected handlers. The responses contain VPN usernames, passwords, and tunnel parameters that can be replayed against the corresponding PPTP or L2TP concentrators. No user interaction is required. Refer to the GitHub credential disclosure report and the VulnCheck advisory for endpoint-level request details.

Detection Methods for CVE-2026-76871

Indicators of Compromise

HTTP GET requests to /pptpd_user_show.cgi, /l2tpd_user_show.cgi, or /pptp_client_config_show.cgi from non-administrative sessions.
Requests to mod_vpn_remote/plan.json originating from workstations that do not manage the router.
Unexpected PPTP or L2TP authentications on downstream VPN servers using accounts that should only be stored on the NR255-V.

Detection Strategies

Inspect router access logs for repeated calls to the four affected CGI handlers within short time windows.
Alert on VPN concentrator logins from source IPs that do not match historical baselines for each stored account.
Correlate router web session identifiers with the accounts issuing requests to VPN read handlers.

Monitoring Recommendations

Forward NR255-V web and authentication logs to a centralized log store for retention and search.
Monitor egress traffic from the router management VLAN for anomalous HTTP responses containing credential-like fields.
Track credential rotation events for PPTP and L2TP accounts referenced by the NR255-V.

How to Mitigate CVE-2026-76871

Immediate Actions Required

Restrict access to the NR255-V management interface to a dedicated administrative network segment.
Rotate all PPTP and L2TP credentials and pre-shared keys configured on the affected router.
Disable unused VPN services on the NR255-V until a vendor patch is validated.
Audit router user accounts and remove any low-privilege accounts that do not require web access.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-76871 at the time of publication. Monitor the VulnCheck advisory and Netcore vendor channels for firmware updates addressing the exposed handlers.

Workarounds

Block external access to the router HTTP and HTTPS management ports at the perimeter firewall.
Enforce IP allow-lists on the router web interface so only administrator workstations can reach the CGI handlers.
Migrate remote access from PPTP and L2TP to a modern VPN protocol with stronger credential protection where feasible.

bash

# Configuration example
# Restrict router management access with an upstream firewall rule
iptables -A FORWARD -p tcp -d <NR255V_IP> --dport 80 -s <ADMIN_SUBNET> -j ACCEPT
iptables -A FORWARD -p tcp -d <NR255V_IP> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <NR255V_IP> --dport 443 -s <ADMIN_SUBNET> -j ACCEPT
iptables -A FORWARD -p tcp -d <NR255V_IP> --dport 443 -j DROP