Medium severity4.8NVD Advisory· Published Sep 15, 2026· Updated Sep 16, 2026

CVE-2026-76858

Description

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns_wan_list_show.cgi caused by unsafe eval() handling of DDNS data. Attackers can inject malicious script through the DDNS configuration path, leading to persistent execution when the affected page is viewed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Netcore/NR255-Vllm-fuzzy
Range: 1.5.130703
Draw Ctf/Netcore Router Public Refsllm-fuzzy
Range: 1.5.130703

Patches

Vulnerability mechanics

References

github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-ddns-stored-xss.mdnvd
www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-stored-cross-site-scripting-via-ddns-eval-in-ddns-wan-list-show-cginvd

News mentions

Draw Ctf Netcore Routers: 24 Vulnerabilities Disclosed, Ranging from XSS to Firmware Exploits
Vypr Intelligence · Sep 15, 2026

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000