Draw Ctf Netcore Routers: 24 Vulnerabilities Disclosed, Ranging from XSS to Firmware Exploits
Draw Ctf Netcore routers face a massive disclosure of 24 vulnerabilities, including high-severity command injection, buffer overflows, and information leaks.
Key findings
- 24 vulnerabilities disclosed on September 15, 2026, affect Draw Ctf Netcore NR255-V and NR268 routers.
- High-severity flaws include stack-based buffer overflows, command injection, and firmware integrity bypasses.
- Multiple stored XSS vulnerabilities exist across various configuration interfaces.
- Sensitive information disclosure affects VPN credentials, session data, and captive-portal secrets.
- Denial-of-service and CSRF vulnerabilities are also present, impacting device stability and configuration integrity.
- Affected firmware versions are 1.5.130703 (NR255-V) and 1.7.121109 (NR268).
On September 15, 2026, a significant batch of 24 vulnerabilities was disclosed for Draw Ctf's Netcore Router products, specifically affecting the NR255-V and NR268 models. These vulnerabilities, all disclosed on the same day, span a range of severity levels, with several rated as High. The disclosures highlight critical weaknesses in firmware versions 1.5.130703 for the NR255-V and 1.7.121109 for the NR268, impacting core functionalities such as network configuration, VPN management, and system updates.
Several vulnerabilities revolve around stored cross-site scripting (XSS) and command injection flaws. CVE-2026-92257, CVE-2026-76873, CVE-2026-76872, CVE-2026-76867, and CVE-2026-76858 are all stored XSS vulnerabilities found in various configuration pages, including L7 content management, DHCP, ARP, routing, and DDNS settings. These flaws allow attackers to inject persistent script payloads that can execute when administrators access these pages. Additionally, CVE-2026-76866 (CVE-2026-76866) and CVE-2026-76862 (CVE-2026-76862) represent OS command injection vulnerabilities. The former allows attackers to inject arguments into DDNS commands, while the latter targets Nettools tcpdump launch paths, enabling the execution of arbitrary commands with root privileges.
Sensitive information disclosure is another prevalent theme within this batch. CVE-2026-92256 and CVE-2026-76871 expose stored IPsec PSK and RSA key material, as well as PPTP and L2TP VPN credentials, respectively, through various CGI endpoints related to VPN configuration. CVE-2026-76859 further exacerbates this by disclosing router credentials via the user_pass_show.cgi component. Other information disclosure vulnerabilities include CVE-2026-76863, which allows authenticated users to access sensitive QoS telemetry, and CVE-2026-76855 and CVE-2026-76854, which expose user session data and captive-portal credentials.
High-severity vulnerabilities include stack-based buffer overflows and firmware integrity issues. CVE-2026-76869 (stack-based buffer overflow in reboot_timer_set.cgi), CVE-2026-76861 (stack-based buffer overflow in ntools_tcpdump_start_set.cgi), and CVE-2026-76860 (stack-based buffer overflow in wake_up_set.cgi) all stem from improper input handling, potentially allowing arbitrary code execution. CVE-2026-76852 presents a critical flaw in the NR268 firmware, where improper integrity verification in mtd_write allows attackers to bypass firmware signature validation and load unauthorized firmware images. Furthermore, CVE-2026-76853 details a security check bypass in the NR268's restore archive handling.
The batch also includes denial-of-service (DoS) vulnerabilities. CVE-2026-76868 and CVE-2026-76865 are null pointer dereferences occurring in route policy and QoS settings, respectively, triggered by missing or unchecked parameters, leading to DoS conditions. CVE-2026-76864 involves a stored XSS vulnerability in QoS rule names that can lead to DoS when processed. Finally, CVE-2026-76856 is a cross-site request forgery (CSRF) vulnerability affecting WAN and LAN configuration endpoints, allowing attackers to trick administrators into making unauthorized changes.
All disclosed vulnerabilities affect specific firmware versions: 1.5.130703 for the Netcore NR255-V and 1.7.121109 for the Netcore NR268. Users are strongly advised to update their devices to patched firmware versions as soon as they become available. The sheer number and variety of vulnerabilities underscore the importance of regular security audits and timely patching for network infrastructure devices.
Key Findings:
- 24 vulnerabilities disclosed on September 15, 2026, affect Draw Ctf Netcore NR255-V and NR268 routers.
- High-severity flaws include stack-based buffer overflows, command injection, and firmware integrity bypasses.
- Multiple stored XSS vulnerabilities exist across various configuration interfaces.
- Sensitive information disclosure affects VPN credentials, session data, and captive-portal secrets.
- Denial-of-service and CSRF vulnerabilities are also present, impacting device stability and configuration integrity.
- Affected firmware versions are 1.5.130703 (NR255-V) and 1.7.121109 (NR268).
CVE IDs: CVE-2026-92257, CVE-2026-92256, CVE-2026-76873, CVE-2026-76872, CVE-2026-76871, CVE-2026-76870, CVE-2026-76869, CVE-2026-76868, CVE-2026-76867, CVE-2026-76866, CVE-2026-76865, CVE-2026-76864, CVE-2026-76863, CVE-2026-76862, CVE-2026-76861, CVE-2026-76860, CVE-2026-76859, CVE-2026-76858, CVE-2026-76857, CVE-2026-76856, CVE-2026-76855, CVE-2026-76854, CVE-2026-76853, CVE-2026-76852