CVE Feed

    Dashboard / CVE / CVE-2026-76870

    CVE-2026-76870

    Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in the mtd_write pre-flash validation routine triggered by short firmware uploads. Attackers can upload a truncated firmware image via put_file_cgi.c to trigger out-of-bounds reads across main.c, check_image_uuid.c, and oemMD5Update.c.

    Published:Sep 15, 2026
    Last Modified:Sep 17, 2026
    EPS:Sep 15, 2026
    EPSS Score:0.00314
    CVSS Score:7.1

    Affected Products

    Vendor
    Netcore
    Product
    Nr255-v

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-92257 (CVSS 5.1) — Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content manageme…
    CVE-2026-92256 (CVSS 7.1) — NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.…
    CVE-2026-92255 (CVSS 5.3) — Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi cau…
    CVE-2026-76873 (CVSS 5.1) — Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP…
    CVE-2026-76872 (CVSS 5.1) — Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and …
    CVE-2026-76871 (CVSS 7.1) — Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote…
    CVE-2026-76869 (CVSS 8.6) — Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in reboot_timer_set.cgi caused by im…
    CVE-2026-76868 (CVSS 6.9) — Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in route_policy_add.cgi c…
    CVE-2026-76867 (CVSS 5.1) — Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing an…
    CVE-2026-76866 (CVSS 8.6) — Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS inp…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High