CVE-2026-76862

Netcore NR255-V router firmware version 1.5.130703 contains an OS command argument injection vulnerability (CWE-88) in the device's Nettools tcpdump launch paths, specifically the ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, exe_default, and ntools_proc components. An attacker with low privileges (per the CVSS 4.0 vector, PR:L) can supply crafted arguments to these tcpdump launch routines, which are passed unsafely to the underlying system command and allow arbitrary commands to be manipulated and executed on the router. Successful exploitation gives the attacker high-impact control over the device's confidentiality, integrity, and availability (VC:H/VI:H/VA:H), effectively full compromise of the router. Organizations running the NR255-V at the affected firmware version with the web management interface reachable are exposed. No public proof-of-concept is known and the CVE is not on the CISA KEV list, so exploitation is currently none known.

What to do: Contact Netcore for a fixed firmware version, as no patched release is identified in the disclosure. Until then, remove the router's management interface from the internet and restrict administrative access to a trusted internal network or VPN, and minimize the number of low-privilege accounts that can reach the Nettools/tcpdump CGI pages. Monitor device logs for unexpected tcpdump processes or administrative sessions hitting ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, and related endpoints.