CVE-2026-92255: Netcore NR255-V Buffer Overflow Vulnerability

CVE-2026-92255 Overview

CVE-2026-92255 is an out-of-bounds read vulnerability affecting Netcore NR255-V firmware version 1.5.130703. The flaw resides in the filter_arp_put_file.cgi component and stems from improper use of a string handling API. An authenticated attacker on the network can trigger an unterminated buffer over-read, causing the affected process to read adjacent memory contents beyond the intended buffer boundary. Successful exploitation may expose fragments of process memory, including potentially sensitive router configuration or runtime data. The issue is tracked under [CWE-125: Out-of-bounds Read].

Critical Impact
Network-adjacent attackers with low privileges can exploit the ARP import handler to leak adjacent memory contents from the router, potentially disclosing sensitive configuration data.

Affected Products

Netcore NR255-V router
Firmware version 1.5.130703
filter_arp_put_file.cgi component

Discovery Timeline

2026-09-15 - CVE-2026-92255 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-92255

Vulnerability Analysis

The vulnerability affects the filter_arp_put_file.cgi binary, which processes ARP-related file uploads or imports on the Netcore NR255-V router. The handler uses a string manipulation API in a manner that does not guarantee proper null-termination or bounds enforcement on the input buffer. When the routine reads through the input, it continues past the intended buffer boundary because the terminator is absent or misplaced. This over-read exposes bytes stored in memory adjacent to the target buffer.

The vulnerability requires network access to the router's management interface and a low level of privilege. No user interaction is required to trigger the flaw. The impact is limited to confidentiality of adjacent memory contents, without direct integrity or full availability consequences.

Root Cause

The root cause is misuse of a string handling function that assumes a properly null-terminated source buffer. When callers supply attacker-controlled data without ensuring termination, the API reads beyond the source buffer until an unrelated null byte is encountered elsewhere in memory. This category of defect maps to [CWE-125] and is common in embedded C code that mixes fixed-size buffers with C standard library string routines.

Attack Vector

An attacker with valid low-privilege credentials sends a crafted HTTP request to the filter_arp_put_file.cgi endpoint. The request supplies ARP-related content that lacks a terminating byte or exceeds expected size assumptions. The vulnerable string handling call then reads past the buffer and returns adjacent memory in a response or subsequent processing artifact. Technical details of the over-read are documented in the GitHub ARP Import Overread Analysis and the VulnCheck Advisory on Netcore NR255.

No verified public exploit code is available. The vulnerability is described in prose based on the referenced advisories.

Detection Methods for CVE-2026-92255

Indicators of Compromise

Unexpected HTTP POST or PUT requests to filter_arp_put_file.cgi from unusual source addresses on the management network.
ARP import payloads containing unusually long entries, missing terminators, or malformed field structures.
Repeated requests from the same authenticated session probing the ARP import endpoint.

Detection Strategies

Inspect router web-management logs for access to filter_arp_put_file.cgi outside normal administrator workflows.
Deploy network sensors that flag oversized or malformed ARP import payloads sent to the router's HTTP interface.
Correlate low-privilege authentication events with subsequent access to configuration CGI endpoints.

Monitoring Recommendations

Restrict and monitor administrative HTTP access to the router from trusted management VLANs only.
Log and retain full HTTP request bodies destined for CGI endpoints to enable retrospective analysis.
Alert on any anomalous outbound data volume from the router that could indicate leaked memory exfiltration.

How to Mitigate CVE-2026-92255

Immediate Actions Required

Restrict access to the router's web management interface to trusted administrative hosts using ACLs or firewall rules.
Rotate administrative credentials to reduce the pool of accounts that could reach the low-privilege attack surface.
Disable remote WAN-side management if it is not required for operations.

Patch Information

No vendor patch is referenced in the available advisories at the time of publication. Consult the VulnCheck Advisory on Netcore NR255 for updates on vendor remediation and firmware releases addressing the filter_arp_put_file.cgi string handling defect.

Workarounds

Place the router's management interface behind a management-only network segment inaccessible from general user VLANs.
Block external access to CGI endpoints, including filter_arp_put_file.cgi, at an upstream firewall.
Consider replacing end-of-life or unpatched consumer router hardware with actively supported models when no fix is forthcoming.

bash

# Configuration example: restrict management access with iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <admin_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP