CVE-2026-92256 Overview
CVE-2026-92256 is a sensitive information disclosure vulnerability in the Netcore NR255-V router running firmware version 1.5.130703. The flaw resides in the CGI read handlers implemented by l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json. An authenticated remote attacker can query l2tpd_config_show.cgi and related endpoints to retrieve stored IPsec Pre-Shared Keys (PSK) and RSA key material. The weakness is classified under CWE-522: Insufficiently Protected Credentials. Disclosure of VPN credentials allows attackers to impersonate remote peers, decrypt captured tunnel traffic, and pivot into networks that terminate on the router.
Critical Impact
Attackers with low-privilege access can extract IPsec PSK and RSA keys, undermining the confidentiality of every VPN tunnel established by the affected device.
Affected Products
- Netcore NR255-V router firmware version 1.5.130703
- L2TP configuration read handler l2tpd_config_show_cgi.c
- IPsec configuration read handler ipsec_show_cgi.c and mod_vpn_remote/plan.json
Discovery Timeline
- 2026-09-15 - CVE-2026-92256 published to the National Vulnerability Database
- 2026-09-16 - Last updated in the NVD database
Technical Details for CVE-2026-92256
Vulnerability Analysis
The NR255-V exposes administrative CGI endpoints that render stored VPN configuration back to the requesting client. The read handlers in l2tpd_config_show_cgi.c and ipsec_show_cgi.c return the full contents of the L2TP and IPsec configuration blobs, including secret material used to authenticate tunnel endpoints. The companion handler mod_vpn_remote/plan.json serializes the same configuration objects into JSON without stripping secret fields.
Because the endpoints reflect PSK and RSA key data rather than opaque identifiers, any actor able to reach the CGI can harvest credentials suitable for offline cryptographic attacks or direct tunnel impersonation. The disclosure impacts confidentiality only; integrity and availability of the router are not directly affected.
Root Cause
The root cause is a design flaw in credential handling. Secret configuration values are stored and rendered in clear form by the CGI read handlers with no field-level redaction, no role separation between viewers and administrators of secrets, and no policy that prevents PSK or private key material from crossing the management-plane boundary. This matches the CWE-522 pattern of insufficiently protected credentials.
Attack Vector
Exploitation is performed over the network against the router's management interface. An attacker submits a request to l2tpd_config_show.cgi, ipsec_show.cgi, or the mod_vpn_remote/plan.json endpoint with valid low-privilege credentials. The server responds with a body containing the IPsec PSK and RSA key values. See the VulnCheck Security Advisory and the GitHub Credential Disclosure Report for the reproduction steps and endpoint layout.
No public exploit tooling or CISA KEV listing exists at time of writing. EPSS reports a low near-term exploitation probability.
Detection Methods for CVE-2026-92256
Indicators of Compromise
- HTTP or HTTPS GET requests to /cgi-bin/l2tpd_config_show.cgi, /cgi-bin/ipsec_show.cgi, or mod_vpn_remote/plan.json originating from unexpected client addresses.
- Response bodies from the router management interface containing IPsec PSK, RSA private key markers, or BEGIN RSA PRIVATE KEY strings.
- Unusual authenticated management sessions from low-privilege accounts that only touch VPN configuration read endpoints.
Detection Strategies
- Enable and forward the router's web administration access log to a central log store and alert on requests to the three vulnerable CGI paths.
- Deploy network-layer inspection on the management VLAN to flag response payloads that carry PSK or PEM-formatted key material.
- Correlate configuration-read events with subsequent unexpected IPsec tunnel establishments sourced from new peer addresses.
Monitoring Recommendations
- Watch for spikes in requests to VPN configuration endpoints outside change windows.
- Track the appearance of your known IPsec PSK values or RSA key fingerprints in external threat intelligence feeds.
- Alert on any management-plane traffic reaching the router from the WAN interface.
How to Mitigate CVE-2026-92256
Immediate Actions Required
- Restrict access to the router's management interface to a trusted administrative subnet and block WAN-side access to all cgi-bin endpoints.
- Rotate every IPsec PSK and reissue all RSA key pairs used by the NR255-V, then re-establish tunnels with the new material.
- Audit administrative accounts on the router and remove or reset any low-privilege credentials that may have been exposed to third parties.
Patch Information
No vendor patch is referenced in the enriched CVE data. Consult the VulnCheck Security Advisory and Netcore support channels for firmware updates addressing the l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json handlers.
Workarounds
- Place the NR255-V management interface behind a VPN or jump host so the CGI handlers are unreachable from untrusted networks.
- Disable the L2TP or IPsec features on the device if VPN termination is not required for the deployment.
- Where feasible, migrate VPN termination to a device that redacts secret fields from configuration read endpoints until a vendor fix is available.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.