CVE-2026-76872: fallo de gravedad media en Netcore NR255-V
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.1epss 0.2%
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Attackers can inject persistent malicious scripts through these components to compromise the web management interface for other users.'
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Productos afectados
Netcore · NR255-VCVEs relacionadas — Netcore NR255-V
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-76861HIGHNetcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_start_set.cgiEPSS 0.7%CVE-2026-76869HIGHNetcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot_timer_set.cgiEPSS 0.6%CVE-2026-76866HIGHNetcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS ParametersEPSS 0.6%CVE-2026-76862HIGHNetcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch PathsEPSS 0.5%CVE-2026-76860HIGHNetcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake_up_set.cgi via MAC and ID TokenizationEPSS 0.5%CVE-2026-76868MEDIUMNetcore NR255-V 1.5.130703 NULL Pointer Dereference in route_policy_add.cgi via Missing exit_portEPSS 0.5%