Netcore NR255-V version 1.5.130703 contains an improper neutralization of input vulnerability during web page generation. Specifically, QoS rule names are not sanitized before being parsed via eval() in the qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi handlers. This allows an attacker to inject persistent cross-site scripting code that executes when the stored QoS rule names are processed by these handlers.

An attacker with high privileges can inject persistent script code via crafted QoS rule names. This script executes in the context of the affected web interface when the stored data is later processed, potentially leading to unauthorized actions or information disclosure within the device's management interface. The CVSS score of 4.8 indicates a medium severity impact with network attack vector, low complexity, and requiring high privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device's management interface to trusted users only and avoid using untrusted input in QoS rule names. Monitor vendor communications for official patches or updates addressing this vulnerability.