CVE-2026-76856

Description

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration settings without consent.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-csrf-wan-reconfig.md ↗
• https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-cross-site-request-forgery-in-wan-lan-configuration-endpoints ↗