CVE-2026-76866

Netcore NR255-V firmware version 1.5.130703 constructs command lines that run as root using unquoted, unsanitized user-supplied DDNS configuration fields in DDNSset_cgi.c and related ddns_Proc.c components. An authenticated attacker with administrator access to the router's web management interface can submit crafted DDNS parameters that inject additional command arguments, which are then executed with root privileges. Successful exploitation gives full control of the device, allowing firewall rule changes, traffic interception, and persistence on the router. Only NR255-V units running firmware 1.5.130703 are confirmed affected. There is no evidence of in-the-wild exploitation, no public PoC, and the CVE is not in CISA's KEV catalog.

What to do: Restrict the router's web management interface to the LAN or a trusted management VPN segment and never expose it directly to the internet. Contact Netcore for a fixed firmware release, since no patched version is confirmed in the disclosure. Review DDNS settings and admin account credentials for unauthorized changes, and consider retiring this legacy model if vendor support has ended.