CVE-2026-76855

Netcore's NR255-V router, running firmware version 1.5.130703, exposes a sensitive information disclosure flaw (CWE-359) in its web-based audit subsystem, specifically the endpoints implemented in l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and mod_dispatch_auth/plan.. A low-privileged authenticated attacker on the router's web interface can query these audit components over the network with low complexity and retrieve other users' session data and browsing history, including records spanning past sessions. Successful abuse enables cross-user session hijacking and silent surveillance of victim browsing activity, with high confidentiality impact but no direct effect on integrity or availability. Organizations running the NR255-V on this firmware are affected; no public proof of concept is known, the flaw is not in the CISA KEV catalog, and there is no evidence of in-the-wild exploitation to date.

What to do: Restrict the NR255-V management/audit web interface to trusted LAN or VPN segments and never expose it to the internet, since exploitation only requires a low-privileged web account. Contact Netcore for a firmware newer than 1.5.130703, and given the age of this build (July 2013), plan to retire or replace the device if no patched release exists. Review audit log access records for unexpected queries against the audit/log-dump endpoints and rotate user sessions and credentials if anomalous access is found.