CVE-2026-76871: Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Ha

Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlers

Status

Published

2026-09-15

Updated

2026-09-21

Assigning organization

VulnCheck

Description

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Netcore NR255-V

Default version status: unaffected

1.5.130703affected

References

https://github.com/draw-ctf/netcore-router-public-refs/blob/main/2026.08.19-netcore-nr255v-pptp-l2tp-cred-disclosure.md ↗
https://www.vulncheck.com/advisories/netcore-nr255-v-1.5.130703-sensitive-information-disclosure-via-vpn-read-handlers ↗