Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-76858

Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi

CVSS 4.0 4.8 MEDIUMCVSS 3.1 4.8 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-76858

Published

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns_wan_list_show.cgi caused by unsafe eval() handling of DDNS data. Attackers can inject malicious script through the DDNS configuration path, leading to persistent execution when the affected page is viewed.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-76858

Published

NR255-V

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Netcore",
                    "product": "NR255-V",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "1.5.130703",
                            "status": "affected",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON