Threats affecting pkg:github/draw-ctf/netcore-router-public-refs

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content.

Netcore NR255-V version 1.5.130703 has a vulnerability that allows attackers to disclose sensitive information. Specifically, querying certain CGI endpoints can expose stored IPsec pre-shared keys (PSK) and RSA key material. This vulnerability is due to insufficient protection of credentials in the device's web interface handlers.

Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component, potentially exposing adjacent memory contents.

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting (XSS) vulnerability in the DHCP dynamic IP display and ARP bind list components. This vulnerability arises from improper neutralization of input in hostname fields, allowing a LAN-based attacker to inject malicious scripts that are rendered in the web management interface.

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Attackers can inject persistent malicious scripts through these components to compromise the web management interface for other users.'

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials.

Netcore NR255-V version 1.5.130703 has a null pointer dereference vulnerability in the route_policy_add.cgi component. This occurs when a request is sent without the required exit_port parameter, causing the device to dereference a null pointer and leading to a denial of service condition.

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSset_cgi.c and related ddns_Proc.c components, enabling os command argument injection. Attackers can exploit the unsanitized parameters to inject additional command arguments executed with root privileges.

Netcore NR255-V version 1.5.130703 has a null pointer dereference vulnerability in its QoS setter CGI handlers due to unchecked atoi() results. This flaw can be triggered by an attacker supplying crafted input, leading to a denial of service condition.

NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is later processed by the affected handlers.'

Netcore NR255-V version 1.5.130703 has a vulnerability where authenticated users with broad roles can access QoS read routes to disclose sensitive live network telemetry beyond their intended privileges. This is due to incorrect authorization in handling mod_qos_bandwidth plan.json within specific CGI components.

Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launch paths, including ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, exe_default, and ntools_proc components. Attackers can inject crafted arguments into these tcpdump launch routines to manipulate executed system commands on the device.

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntools_tcpdump_start_set.cgi caused by an unsized sprintf call when processing form values. An attacker can submit crafted input to this cgi endpoint to overflow the stack buffer and potentially execute arbitrary code.

Netcore NR255-V version 1.5.130703 has a stack-based buffer overflow vulnerability in the wake_up_set.cgi component. This occurs due to unbounded tokenization of MAC and ID inputs, allowing crafted values to overflow the stack buffer and corrupt program memory. The vulnerability has a high severity with a CVSS score of 8.7.

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the user_pass_show.cgi component. Low-privilege attackers can exploit this flaw via ui_config_2.xml and misc.js to disclose router credentials.

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting (XSS) vulnerability in the ddns_wan_list_show.cgi component. This vulnerability arises from unsafe use of eval() on DDNS data, allowing attackers to inject malicious scripts that persist and execute when the affected page is viewed. The CVSS score is 4.8, indicating a medium severity issue.

Netcore NR255-V version 1.5.130703 has a vulnerability that allows unauthorized actors to access sensitive personal information through audit endpoints. Specifically, attackers can query audit components to retrieve other users' session and browsing history data across sessions. This exposure of private information poses a high-severity risk.

Netcore NR268 firmware version 1.7.121109 has a security check bypass vulnerability due to missing support for integrity check in the restore archive prefix validation. This flaw allows attackers with limited privileges to bypass restrictions on restore archive handling by exploiting a flawed prefix check in the put_parame_file_cgi.c component.

Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtd_write allowing forged firmware authenticity checks. Attackers can exploit put_file.cgi and check_image_uuid.c to bypass firmware signature validation and load unauthorized firmware images.