CVE-2026-76854

Netcore NR255-V router firmware version 1.5.130703 contains a sensitive information disclosure vulnerability (CWE-522, insufficiently protected credentials) in the l7_web_auth_user_show.cgi component, which handles captive-portal user data. A remote attacker with low privileges (per the CVSS 4.0 vector, PR:L) can query this CGI endpoint over the network and retrieve captive-portal user credentials. Successful exploitation compromises the confidentiality of authenticated network access, allowing an attacker to impersonate portal users and gain network access under their accounts. Organizations running the affected NR255-V firmware with the captive portal feature enabled are exposed. No public proof-of-concept exists and the flaw is not listed in the CISA KEV catalog, so exploitation is currently unknown.

What to do: Restrict access to the router's web management interface and CGI endpoints (including l7_web_auth_user_show.cgi) to trusted internal networks or a management VLAN, and verify firewall rules do not expose management to the internet. Contact Netcore for a fixed firmware version for the NR255-V, as no patched version is specified in the advisory. If the captive portal is or was in use, rotate all portal user credentials and review authentication logs for unexplained queries to the affected endpoint.