CVE-2026-76857

Netcore NR255-V routers running firmware 1.5.130703 store and return DDNS (dynamic DNS) credentials in plaintext through the ddns_wan_list_show.cgi CGI endpoint, with related exposure in the DDNSset_cgi, IGD_GetCgiHandler, and IGD_CgiCall components (CWE-522). An attacker who reaches this CGI handler with low privileges (the CVSS 4.0 vector requires PR:L, suggesting an authenticated or low-privilege session) can retrieve the router's configured DDNS usernames and passwords in cleartext. This exposes the victim's DDNS provider account, potentially allowing account takeover, DNS hijacking of the associated domain, and lateral reuse of those credentials if they are shared elsewhere. The flaw is rated 7.1 (high) under CVSS 4.0. It is not listed in CISA's KEV catalog, no public proof-of-concept is known, and there is no evidence of exploitation in the wild.

What to do: Contact Netcore for a firmware update and upgrade the NR255-V off version 1.5.130703 as soon as a fixed build is available. Immediately rotate the DDNS provider credentials configured on any affected unit and review that DDNS account for unauthorized changes. Restrict the router's web/CGI management interface to trusted LAN or VPN access and never expose it directly to the internet.