CVE-2026-76854: Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth

Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi

Status

Published

2026-09-15

Updated

2026-09-17

Assigning organization

VulnCheck

Description

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cgi related to captive-portal credential handling. Attackers can query this component to obtain captive-portal user credentials, compromising confidentiality of authenticated network access.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Netcore NR255-V

Default version status: unaffected

1.5.130703affected

References

https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-captive-portal-cred-disclosure.md ↗
https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-sensitive-information-disclosure-via-l7-web-auth-user-show-cgi ↗