CVE-2026-76860: fallo de gravedad alta en Netcore NR255-V
Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake_up_set.cgi via MAC and ID Tokenization
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.5%
Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in wake_up_set.cgi caused by unbounded tokenization of MAC and ID input. Attackers can supply crafted MAC and ID values to the affected endpoint to overflow the stack buffer and corrupt program memory.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Netcore · NR255-VCVEs relacionadas — Netcore NR255-V
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-76861HIGHNetcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_start_set.cgiEPSS 0.7%CVE-2026-76869HIGHNetcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot_timer_set.cgiEPSS 0.6%CVE-2026-76866HIGHNetcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS ParametersEPSS 0.6%CVE-2026-76862HIGHNetcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch PathsEPSS 0.5%CVE-2026-76868MEDIUMNetcore NR255-V 1.5.130703 NULL Pointer Dereference in route_policy_add.cgi via Missing exit_portEPSS 0.5%CVE-2026-76865MEDIUMNetcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter HandlersEPSS 0.5%