CVE-2026-76873 is a stored cross-site scripting vulnerability affecting Netcore NR255-V version 1.5.130703. The vulnerability arises from improper neutralization of input in hostname fields used by the DHCP dynamic IP display and ARP bind list display components. Malicious scripts injected into these fields are rendered by the web management interface's JavaScript files (network_config.js and network_security.js), enabling a LAN-based attacker to execute arbitrary scripts in the context of the administrator's browser session.

An attacker with LAN access can inject malicious scripts into hostname fields that are stored and later rendered by the device's web management interface. This can lead to cross-site scripting attacks, potentially allowing the attacker to execute arbitrary scripts in the administrator's browser, which may result in session hijacking, unauthorized actions, or information disclosure within the management interface context. The CVSS 4.0 score is 5.1 (medium severity), reflecting the local attack vector and limited scope of impact.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict LAN access to trusted users only and avoid using the vulnerable management interface from untrusted hosts.