CVE-2026-76860

Netcore NR255-V router firmware version 1.5.130703 contains a stack-based buffer overflow (CWE-121) in the wake_up_set.cgi endpoint, caused by unbounded tokenization of the MAC and ID parameters. An attacker with low-privilege access to the device's web management interface can submit crafted MAC and ID values that overflow a fixed-size stack buffer and corrupt program memory. Successful exploitation can yield full compromise of the router's confidentiality, integrity, and availability, most plausibly remote code execution under the device's privileged web/CGI process, enabling traffic interception or pivoting into the internal network. This firmware build dates to 2013 (version string 1.5.130703), so affected units are likely long-deployed, unpatched small-business/VPN routers primarily in Netcore's China market. No public proof-of-concept or confirmed in-the-wild exploitation has been reported to date.

What to do: Check with Netcore for a fixed firmware release for the NR255-V, as 1.5.130703 is the only confirmed affected version and no patched build is documented in the advisory. In the interim, restrict the router's web management interface to trusted LAN segments or a management VPN, disable remote/WAN-side administration, and enforce strong non-default credentials since exploitation requires low-privilege authentication. Monitor device logs for unexpected requests to wake_up_set.cgi and consider replacing end-of-life units that cannot be patched.