Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-76866

Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters

CVSS 4.0 8.6 HIGHCVSS 3.1 7.2 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-76866

Published

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSset_cgi.c and related ddns_Proc.c components, enabling os command argument injection. Attackers can exploit the unsanitized parameters to inject additional command arguments executed with root privileges.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-76866

Published

NR255-V

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Netcore",
                    "product": "NR255-V",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "1.5.130703",
                            "status": "affected",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON