CVE-2026-76858 is a stored cross-site scripting vulnerability in Netcore NR255-V version 1.5.130703. The vulnerability exists in the ddns_wan_list_show.cgi script due to unsafe handling of DDNS data via the eval() function. This allows attackers with high privileges to inject malicious scripts into the DDNS configuration path, which persist and execute when the vulnerable page is accessed. The CVSS 4.0 vector indicates network attack vector, low complexity, no attack tampering, high privileges required, partial user interaction, and low impact on confidentiality, integrity, and availability.

An attacker with high privileges can inject persistent malicious scripts into the DDNS configuration, which execute when the affected page is viewed. This could lead to script execution in the context of the affected web interface, potentially enabling actions such as session hijacking or unauthorized actions within the management interface. However, the impact is limited by the requirement for high privileges and partial user interaction.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the management interface to trusted users only and avoid viewing the affected page with untrusted input.