CVE-2026-76872: Netcore NR255-V XSS Vulnerability

CVE-2026-76872 Overview

CVE-2026-76872 is a stored cross-site scripting (XSS) vulnerability in the Netcore NR255-V router, firmware version 1.5.130703. The flaw resides in the DHCP static IP and IP Access Control List (ACL) management pages exposed through the web administration interface. Affected Common Gateway Interface (CGI) endpoints include dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. An authenticated attacker can inject persistent JavaScript payloads that execute in the browser of any administrator who later loads the affected pages. The issue is tracked as CWE-79.

Critical Impact
Stored payloads execute in administrator browsers, enabling session hijacking, unauthorized configuration changes, and pivoting into the internal network through the router management plane.

Affected Products

Netcore NR255-V router
Firmware version 1.5.130703
Web management interface CGI handlers: dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, ip_acl_show_cgi

Discovery Timeline

2026-09-15 - CVE-2026-76872 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-76872

Vulnerability Analysis

The Netcore NR255-V web management interface fails to sanitize or contextually encode user-supplied values written to the DHCP static IP and IP ACL configuration stores. When an attacker submits a crafted parameter to dhcp_add_staticip_cgi or ip_acl_set_cgi, the router persists the raw input. The corresponding display endpoints, dhcp_staticip_show_cgi and ip_acl_show_cgi, later render that value directly into the HTML response. Any script embedded in the stored value executes in the context of the administrator session that loads the page.

Because the payload lives in device configuration, it persists across reboots and reloads. Exploitation requires low-privileged authentication and one user interaction to trigger the payload in a privileged session.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The CGI handlers accept configuration inputs without server-side validation or output encoding, and the rendering templates emit these values into HTML without HTML-entity escaping.

Attack Vector

The attack vector is network-adjacent through the router's HTTP management interface. An attacker with valid credentials to the web UI—or one who has coerced an administrator through a Cross-Site Request Forgery (CSRF) chain—submits a payload to one of the vulnerable CGI endpoints. When an administrator visits the corresponding list page, the payload executes with full DOM access to the management interface. This enables theft of session tokens, silent modification of firewall rules, DNS entries, or ACL entries, and use of the router as a beachhead into the LAN.

No verified public exploit code is available. Refer to the GitHub Stored XSS Report and the VulnCheck Advisory on XSS for technical write-ups.

Detection Methods for CVE-2026-76872

Indicators of Compromise

DHCP static IP or IP ACL entries containing HTML tags such as <script>, <img>, <svg>, or event handler attributes like onerror= and onload=.
Outbound HTTP requests from administrator workstations to unfamiliar hosts immediately after loading the router management UI.
Unexpected changes to firewall, DNS, or ACL configuration on the NR255-V that do not correspond to authorized administrator activity.

Detection Strategies

Periodically export the router's DHCP static IP and IP ACL tables and grep for HTML metacharacters (<, >, ", ') or JavaScript keywords in stored fields.
Inspect web server access logs on the device (where available) for POST requests to dhcp_add_staticip_cgi and ip_acl_set_cgi containing encoded script payloads.
Monitor administrator browser sessions for anomalous JavaScript execution or DOM modifications when viewing router configuration pages.

Monitoring Recommendations

Alert on new DHCP static reservations or ACL entries with hostnames or descriptions containing non-alphanumeric characters outside the expected schema.
Correlate administrator authentication events with subsequent unauthorized configuration writes to identify hijacked sessions.
Track HTTP referer chains involving the router management interface to identify CSRF-driven injection attempts.

How to Mitigate CVE-2026-76872

Immediate Actions Required

Restrict access to the NR255-V web management interface to a dedicated management VLAN or a small allow-list of administrator IPs.
Change default and shared administrator credentials and enforce unique passwords for each administrator account.
Audit existing DHCP static IP and IP ACL entries and remove any records containing HTML or script content.
Access the router management UI only from a dedicated, hardened browser profile with no persistent sessions to other applications.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Consult the VulnCheck Advisory on XSS and the vendor support channel for firmware updates addressing version 1.5.130703.

Workarounds

Disable remote (WAN-side) administration and require on-LAN access for all configuration changes.
Log out of the router management interface immediately after each administrative session to reduce the window for stored payload execution.
Deploy a browser-level Content Security Policy (CSP) enforcing extension or a script-blocking extension when accessing the router UI to limit inline script execution.
Where feasible, replace the affected firmware or device with a model that receives active security maintenance.

bash

# Example: restrict router management access to a single admin host via upstream firewall
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80  -s 10.0.0.25 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -s 10.0.0.25 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80  -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -j DROP