Threats tagged 'ghsa-5r7c-rr63-2rwm'

Netcore NR256CN devices up to version 1.5.140116 have an authentication bypass vulnerability. This flaw allows unauthenticated attackers to access protected management CGI handlers by prefixing the URI with certain public routes such as l7_web_auth.cgi or .ico paths. The vulnerability enables attackers to invoke management functions without valid credentials. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.