CVE-2026-76873 Overview
CVE-2026-76873 is a stored cross-site scripting vulnerability [CWE-79] in the Netcore NR255-V router, firmware version 1.5.130703. The flaw resides in the DHCP dynamic IP display and ARP bind list display components, which process client-supplied hostname fields without proper output encoding. An attacker on the local area network (LAN) can inject malicious JavaScript through a hostname field. The payload is later rendered by network_config.js and network_security.js in the router's web management interface, executing in the browser session of any administrator who views the affected pages.
Critical Impact
Successful exploitation allows a LAN-based attacker to execute arbitrary script in the router administrator's browser, potentially leading to session hijacking, credential theft, or unauthorized configuration changes.
Affected Products
- Netcore NR255-V router, firmware version 1.5.130703
- Web management interface components network_config.js and network_security.js
- DHCP dynamic IP display and ARP bind list display features
Discovery Timeline
- 2026-09-15 - CVE-2026-76873 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-76873
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw affecting the Netcore NR255-V router's web-based administration interface. The router collects hostname values from DHCP client requests and ARP binding entries associated with devices on the LAN. These hostname values are stored server-side and later rendered into the administrator-facing DHCP dynamic IP list and ARP bind list views.
Because the hostname field is treated as trusted display data, it is written into the DOM without HTML encoding. Any attacker with the ability to place a device on the LAN can supply a crafted hostname containing script content. When the administrator opens the DHCP or ARP status pages, the JavaScript executes with the same privileges as the administrator's session.
Exploitation requires adjacent network access and user interaction from an administrator, which is reflected in the CVSS 4.0 attack characteristics. The impact spans confidentiality and integrity of both the vulnerable component and downstream systems reachable from the management console.
Root Cause
The root cause is missing output encoding in the JavaScript rendering logic of network_config.js and network_security.js. Hostname strings received from DHCP DISCOVER/REQUEST messages and ARP-bound entries are inserted directly into the page without HTML entity escaping, violating the standard defense against reflected and stored XSS.
Attack Vector
An attacker connects a device to the target LAN and issues a DHCP request in which the hostname option (option 12) contains an XSS payload. Alternatively, the attacker registers an ARP binding entry with a malicious hostname. The payload is persisted by the router and executes when the administrator subsequently views the DHCP client list or ARP bind list in the web console. Refer to the VulnCheck Stored XSS Advisory and the GitHub XSS Vulnerability Report for full technical details.
Detection Methods for CVE-2026-76873
Indicators of Compromise
- DHCP lease records containing hostname strings with HTML tags, angle brackets, or JavaScript keywords such as <script>, onerror=, or javascript:.
- ARP table entries where the associated hostname field contains non-standard characters inconsistent with RFC 1123 hostname syntax.
- Unexpected administrator sessions, configuration changes, or new firewall/port-forwarding rules on the NR255-V router.
Detection Strategies
- Inspect DHCP server logs and router lease tables for hostname values that fail hostname validation (letters, digits, hyphens only).
- Monitor the router's web management interface for outbound requests to attacker-controlled domains initiated from administrative pages.
- Review browser console errors or content security policy violations when accessing the DHCP or ARP status views.
Monitoring Recommendations
- Capture DHCP option 12 (hostname) values at the network edge and alert on payloads exceeding normal length or containing script syntax.
- Track administrator authentication events to the NR255-V and correlate with unusual configuration writes.
- Enable network traffic logging on the management VLAN to identify suspicious sessions to the router's web UI.
How to Mitigate CVE-2026-76873
Immediate Actions Required
- Restrict access to the router's web management interface to trusted administrative hosts or a dedicated management VLAN.
- Segment untrusted devices, guest networks, and IoT endpoints away from the LAN that hosts the NR255-V administration interface.
- Instruct administrators to avoid viewing the DHCP client list or ARP bind list until a vendor patch is applied.
Patch Information
No vendor patch is referenced in the published advisory at the time of NVD publication. Monitor the VulnCheck advisory and Netcore vendor communications for firmware updates that address hostname output encoding in network_config.js and network_security.js.
Workarounds
- Enforce static DHCP reservations and disable dynamic hostname display where feasible.
- Use a browser session isolated from other administrative activity when accessing the router UI to limit the blast radius of any executed script.
- Deploy a browser-based content filter or NoScript-style extension to block inline script execution on the router's admin origin.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
