Netcore NR255-V EUVD-2026-80038

Exploitation requires a valid administrative session or admin credentials for the NR255-V web management interface - the CVSS 4.0 vector states PR:H with UI:N, so no user interaction beyond the attacker's own authenticated request is needed, but the attacker must already be authenticated at the highest privilege level. The DDNS configuration feature must be reachable and usable through that interface; an operator who has disabled the Dynamic DNS service or blocked the management UI from untrusted networks removes the exposed input path. The target must be a Netcore NR255-V running firmware 1.5.130703 (or a build sharing the same DDNSset_cgi.c/ddns_Proc.c implementation). Limiting factors: no authentication bypass is described, so this is not remotely exploitable by an unauthenticated party; and device-level shell access is achieved only after the privileged web request is processed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity flaw that nonetheless requires high privileges - meaning an attacker must already hold a valid administrative session or credentials for the router's web interface, which materially narrows the realistic attack surface compared with an unauthenticated remote flaw. No KEV listing and no EPSS score were supplied, so active exploitation cannot be confirmed from this data set; the disclosure originates from VulnCheck with a public reference writeup rather than an observed campaign. That said, routers in this class are frequently deployed with default or weak admin credentials and exposed management interfaces, so the privilege barrier is often nominal in practice, and the post-exploitation impact is total (root on a network-edge device). Treat it as a high-priority patch item for any fleet that exposes the NR255-V management UI, and note that even a mid-sized municipal IT team in walbrzych should treat this as urgent if the model is on their network edge. Key uncertainties: absence of EPSS/KEV data means real-world exploitation frequency is unverified, and the high-privilege prerequisite is the single biggest factor separating this from a mass-exploitation candidate.

An attacker who has obtained or guessed the router's administrative credentials (or reached an improperly exposed management interface) logs into the web UI and submits a crafted DDNS configuration whose fields carry additional command arguments. The unquoted input is concatenated into a root-run command line by DDNSset_cgi.c, so the injected arguments execute with root privileges on the embedded Linux system. From there the attacker can read stored credentials, alter firewall and DNS behavior to redirect LAN traffic, or pivot into the internal network.