EUVD-2026-80059
GHSA-69qw-j4gf-89pq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration settings without consent.
AnalysisAI
Cross-site request forgery in the Netcore NR255-V wireless router's web management interface (firmware 1.5.130703) allows an attacker to silently rewrite WAN and LAN settings by luring a logged-in administrator to a malicious page, which then fires forged requests at the wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi endpoints. The supplied CVSS 4.0 vector (7.0, AV:N/AC:L/AT:N/PR:N/UI:A) indicates the attacker does not need credentials of their own but must get an authenticated admin to actively interact, and that the resulting integrity and availability impacts are High while confidentiality is unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today