CVE-2026-76859

Netcore NR255-V router firmware version 1.5.130703 contains a sensitive information disclosure vulnerability (CWE-522, insufficiently protected credentials) in the user_pass_show.cgi component. An attacker with only low-privilege (non-admin) access to the router's web management interface can leverage the ui_config_2.xml configuration endpoint and misc.js to retrieve stored router credentials, exposing the administrative login. Successful exploitation gives the attacker full administrative control of the device, enabling traffic interception, configuration changes, and pivot access to the internal network. Only NR255-V running version 1.5.130703 is confirmed affected; no fixed version has been publicly specified in the available data. There is no known public proof-of-concept and no evidence of exploitation in the wild, and the flaw is not on the CISA Known Exploited Vulnerabilities list.

What to do: Contact Netcore for a firmware version newer than 1.5.130703 that removes credential exposure from user_pass_show.cgi; if no patch exists, restrict the web management interface to trusted LAN/VPN access only so low-privilege or remote users cannot reach the endpoint. Rotate the router's administrative and any user account passwords, treating existing credentials as potentially disclosed if low-privilege accounts existed or the management interface was remotely reachable.