CVE-2026-92257: Netcore NR255-V Stored XSS Vulnerability

CVE-2026-92257 Overview

CVE-2026-92257 is a stored cross-site scripting vulnerability [CWE-79] in the Netcore NR255-V router, version 1.5.130703. The flaw resides in the Layer 7 (L7) content management pages, which pass user-supplied input into JavaScript eval() sinks. Attackers with authenticated access can inject persistent script payloads through the call board text and policy group handling components. When another user views the affected content, the malicious script executes in their browser context. This enables session theft, administrative action forgery, and pivoting into the router's management interface.

Critical Impact
Authenticated attackers can persist JavaScript in the router web interface and execute it against any administrator who visits the affected L7 management pages.

Affected Products

Netcore NR255-V router
Firmware version 1.5.130703
L7 content management module (call board text and policy group components)

Discovery Timeline

2026-09-15 - CVE-2026-92257 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-92257

Vulnerability Analysis

The vulnerability affects the L7 content management interface on the NR255-V router. Two components mishandle user-supplied strings: the call board text handler and the policy group configuration handler. Both components pass attacker-controlled input into JavaScript eval() sinks in the web management UI. Because the input is stored server-side and rendered on subsequent page loads, the payload persists across sessions and executes for every viewer of the affected page.

Exploitation requires low-level authentication to the router web interface and user interaction from the victim. Successful execution runs arbitrary JavaScript in the origin of the router's administrative panel. An attacker can steal session tokens, submit forged configuration changes, or stage further attacks against connected clients.

Root Cause

The root cause is unsafe use of the JavaScript eval() function on stored, user-controlled input. The firmware does not perform contextual output encoding or input sanitization before the data is embedded in a script sink. Any string a low-privileged administrator supplies to the call board or policy group fields is later interpreted as executable JavaScript.

Attack Vector

The attack is delivered over the network against the router's HTTP management interface. An authenticated attacker submits a crafted string containing a JavaScript payload to the call board or policy group fields. The payload is stored in the device configuration. When any user, including a higher-privileged administrator, navigates to the affected L7 management page, the browser evaluates the payload. Refer to the VulnCheck Advisory for Netcore NR255 and the GitHub Stored XSS Report for reproduction details.

// No verified exploitation code is published for CVE-2026-92257.
// See the linked advisories for reproduction steps.

Detection Methods for CVE-2026-92257

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or JavaScript keywords stored in call board text fields or policy group names on the NR255-V.
Outbound HTTP requests from administrator browsers to unfamiliar hosts immediately after loading the L7 content management page.
Configuration changes to the router that do not correlate with a known administrator session.

Detection Strategies

Inspect saved L7 content management configuration exports for characters and tokens associated with script injection, such as <, >, eval(, and event handler attributes.
Monitor router web management access logs for successful authentication from unfamiliar source addresses followed by writes to L7 configuration endpoints.
Correlate administrator browser telemetry with router management URLs to identify anomalous script execution originating from the device UI.

Monitoring Recommendations

Enable and forward router administrative access logs to a centralized log platform for review.
Alert on any modification to L7 content management fields outside approved change windows.
Track browser-side script errors or content security policy violations reported when accessing the router UI.

How to Mitigate CVE-2026-92257

Immediate Actions Required

Restrict access to the NR255-V web management interface to trusted management networks only.
Rotate all administrator credentials on affected devices and audit existing accounts for unauthorized additions.
Review the call board text and policy group configuration fields and remove any content containing script markup or JavaScript syntax.
Instruct administrators to avoid loading the L7 content management pages until the device is remediated.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-92257. Monitor the VulnCheck Advisory for Netcore NR255 and Netcore vendor channels for firmware updates that address the eval() sinks in L7 content handling.

Workarounds

Disable the L7 content management feature if it is not required for network operation.
Place the router management interface behind a management VLAN or VPN and block administrative access from user networks.
Use a dedicated, hardened browser profile with scripting restrictions when administering the device.
Enforce separation of duties so that content submission and content review are performed by different accounts on isolated hosts.

bash

# Example: restrict router management access to a trusted subnet using an upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP