Netcore
Monthly
Netcore NR255-V routers running firmware 1.5.130703 build root-privileged shell command lines from unquoted DDNS configuration input in DDNSset_cgi.c and related ddns_Proc.c code, letting an authenticated administrator inject extra command arguments that execute as root. Successful abuse yields complete device compromise, including configuration theft, traffic interception, and use of the router as a foothold into the LAN. The CVSS 4.0 vector indicates network reachability with high prerequisites, and no public exploit code or CISA KEV entry was present at time of analysis; the public technical reference writeup is the main disclosure vehicle.
Netcore NR255-V routers running firmware 1.5.130703 build root-privileged shell command lines from unquoted DDNS configuration input in DDNSset_cgi.c and related ddns_Proc.c code, letting an authenticated administrator inject extra command arguments that execute as root. Successful abuse yields complete device compromise, including configuration theft, traffic interception, and use of the router as a foothold into the LAN. The CVSS 4.0 vector indicates network reachability with high prerequisites, and no public exploit code or CISA KEV entry was present at time of analysis; the public technical reference writeup is the main disclosure vehicle.