EUVD-2026-80044
GHSA-xrr8-q5hh-wh9p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Attackers can inject persistent malicious scripts through these components to compromise the web management interface for other users.'
AnalysisAI
Stored cross-site scripting in the Netcore NR255-V router (firmware 1.5.130703) lets a user with access to the web management interface persist malicious JavaScript into DHCP static IP reservations and IP ACL entries via the dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi and ip_acl_show_cgi handlers. The injected script is stored on the device and executes in the browser of any other user — typically a higher-privileged administrator — who opens the affected DHCP or ACL pages, enabling session theft or unauthorised configuration changes performed as that victim. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today