Vulnerability-Lookup

CNVD-2026-38844

Vulnerability from cnvd - Published: 2026-09-28

Title

Netcore NR255 V跨站脚本漏洞（CNVD-2026-38844）

Description

Netcore NR255 V是磊科（netcore）推出的一款‌企业级上网行为管理路由器‌。 Netcore NR255 V存在跨站脚本漏洞，该漏洞源于ddns_wan_list_show.cgi文件中eval()函数对DDNS数据的处理不安全，攻击者可利用该漏洞通过动态域名解析配置路径注入恶意脚本，在用户查看受影响页面时执行，导致信息泄露或会话劫持等危害。

Severity

中

Formal description

目前厂商尚未发布升级程序修复该安全问题，详情见厂商官网： https://www.netcoretec.com/

Reference

https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-ddns-stored-xss.md https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-via-ddns-eval-in-ddns-wan-list-show-cgi

Impacted products

Name
Netcore NR255 V 1.5.130703

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-76858",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-76858"
    }
  },
  "description": "Netcore NR255 V\u662f\u78ca\u79d1\uff08netcore\uff09\u63a8\u51fa\u7684\u4e00\u6b3e\u200c\u4f01\u4e1a\u7ea7\u4e0a\u7f51\u884c\u4e3a\u7ba1\u7406\u8def\u7531\u5668\u200c\u3002\n\nNetcore NR255 V\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eddns_wan_list_show.cgi\u6587\u4ef6\u4e2deval()\u51fd\u6570\u5bf9DDNS\u6570\u636e\u7684\u5904\u7406\u4e0d\u5b89\u5168\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u52a8\u6001\u57df\u540d\u89e3\u6790\u914d\u7f6e\u8def\u5f84\u6ce8\u5165\u6076\u610f\u811a\u672c\uff0c\u5728\u7528\u6237\u67e5\u770b\u53d7\u5f71\u54cd\u9875\u9762\u65f6\u6267\u884c\uff0c\u5bfc\u81f4\u4fe1\u606f\u6cc4\u9732\u6216\u4f1a\u8bdd\u52ab\u6301\u7b49\u5371\u5bb3\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5c1a\u672a\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttps://www.netcoretec.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-38844",
  "openTime": "2026-09-28",
  "products": {
    "product": "Netcore NR255 V 1.5.130703"
  },
  "referenceLink": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-ddns-stored-xss.md\r\nhttps://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-via-ddns-eval-in-ddns-wan-list-show-cgi",
  "serverity": "\u4e2d",
  "submitTime": "2026-09-21",
  "title": "Netcore NR255 V\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2026-38844\uff09"
}

CVE-2026-76858 (GCVE-0-2026-76858)

Vulnerability from cvelistv5 – Published: 2026-09-15 21:57 – Updated: 2026-09-16 19:06

Title

Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi

Summary

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns_wan_list_show.cgi caused by unsafe eval() handling of DDNS data. Attackers can inject malicious script through the DDNS configuration path, leading to persistent execution when the affected page is viewed.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 19:05 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/draw-ctf/netcore-router-public…	third-party-advisory
https://www.vulncheck.com/advisories/netcore-nr25…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Netcore	NR255-V	Affected: 1.5.130703 (custom)

Date Public

2026-09-04 00:00

Credits

Zhou Ao Yin Luxing Jiang Yuxuan Liu Xin @Nebusec

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T19:05:58.226989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:06:08.289Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NR255-V",
          "vendor": "Netcore",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.130703",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhou Ao"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Yin Luxing"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jiang Yuxuan"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Liu Xin"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "@Nebusec"
        }
      ],
      "datePublic": "2026-09-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns_wan_list_show.cgi caused by unsafe eval() handling of DDNS data. Attackers can inject malicious script through the DDNS configuration path, leading to persistent execution when the affected page is viewed."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T21:57:52.802Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Netcore router public references: Stored Cross-site Scripting via DDNS eval() in ddns_wan_list_show.cgi",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-ddns-stored-xss.md"
        },
        {
          "name": "VulnCheck Advisory: Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-via-ddns-eval-in-ddns-wan-list-show-cgi"
        }
      ],
      "title": "Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-76858",
    "datePublished": "2026-09-15T21:57:52.802Z",
    "dateReserved": "2026-08-19T21:47:08.935Z",
    "dateUpdated": "2026-09-16T19:06:08.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2026-38844

CVE-2026-76858 (GCVE-0-2026-76858)

Tags

Sightings

Nomenclature

Related by attack behaviour