EUVD-2026-80048
GHSA-g4f4-vmp7-9gv7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated management access (PR:L) and a victim opening the stored page (UI:R) are required; script executes in another user's browser, warranting scope change S:C.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content.
AnalysisAI
Netcore NR255-V firmware 1.5.130703 stores attacker-supplied script in L7 content management fields - specifically the call board text and policy group handling components - and later renders that content through eval() sinks, so the payload executes in the browser of any user who views the affected page. Exploitation requires an authenticated management session (CVSS PR:L) plus a victim who opens the poisoned page (UI:P), which keeps the practical severity moderate (CVSS 5.1, low confidentiality and integrity impact). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) describes network-reachable exploitation that nevertheless requires a valid low-privileged account and a victim who interacts with the page - consistent with an authenticated admin planting a payload that fires in another operator's session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed firmware version is identified in the supplied references, so the immediate action is to treat the router management plane as untrusted: restrict the L7 content management web interface to a dedicated administrative VLAN or management subnet, disable WAN-side/remote administration if it is enabled, and require administrators to reach the UI only over a trusted path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today