Threat Intelligence Database

Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.

Netcore NR256CN devices up to version 1.5.140116 contain a critical pre-authentication stack-based buffer overflow vulnerability in the Boa web server's user_ok() function. This flaw arises from unbounded strcpy() calls copying Basic-auth usernames into fixed 64-byte stack buffers. An unauthenticated attacker can exploit this by sending a username longer than 63 bytes to any protected /router/*.cgi endpoint, potentially causing a crash or remote code execution.

Netcore NR256CN devices up to version 1.5.140116 have a NULL pointer dereference vulnerability in the Boa web server's user_auth() function. This flaw allows unauthenticated attackers to crash the server by sending a malformed Basic Authorization header missing a colon, causing denial of access to the management interface.

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content.

Netcore NR255-V version 1.5.130703 has a vulnerability that allows attackers to disclose sensitive information. Specifically, querying certain CGI endpoints can expose stored IPsec pre-shared keys (PSK) and RSA key material. This vulnerability is due to insufficient protection of credentials in the device's web interface handlers.

Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. Attackers can trigger an unterminated buffer over-read by exploiting this flaw in the affected component, potentially exposing adjacent memory contents.

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting (XSS) vulnerability in the DHCP dynamic IP display and ARP bind list components. This vulnerability arises from improper neutralization of input in hostname fields, allowing a LAN-based attacker to inject malicious scripts that are rendered in the web management interface.

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp_add_staticip_cgi, dhcp_staticip_show_cgi, ip_acl_set_cgi, and ip_acl_show_cgi. Attackers can inject persistent malicious scripts through these components to compromise the web management interface for other users.'

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials.

Netcore NR255-V version 1.5.130703 has a null pointer dereference vulnerability in the route_policy_add.cgi component. This occurs when a request is sent without the required exit_port parameter, causing the device to dereference a null pointer and leading to a denial of service condition.