Liu Xin

Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get user type.cgi to kill the main Boa process and deny management interface access.

Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.

Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7 web auth.cgi or an .ico route to invoke protected management handlers without credentials.

**Name of the Vulnerable Software and Affected Versions** Netcore NR268 version 1.7.121109 **Description** An improper integrity verification flaw exists in `mtd write`, which allows for forged firmware authenticity checks. Attackers can exploit the 'put file.cgi' endpoint and the `check image uuid.c` file to bypass firmware signature validation and load unauthorized firmware images. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR268 version 1.7.121109 **Description** An issue exists in the restore archive prefix validation within the 'parame put file.cgi' endpoint. Attackers can exploit a flawed prefix check in the `put parame file cgi.c` file to bypass restricted restore archive handling. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** An issue exists in the handling of captive-portal credentials. An attacker can query the 'l7 web auth user show.cgi' endpoint to obtain captive-portal user credentials, which compromises the confidentiality of authenticated network access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** Sensitive information disclosure exists in the audit endpoints handled by `l7 web auth log dump cgi.c`, `audit get cgi.c`, and `mod dispatch auth/plan.json`. Attackers can query these components to obtain session and browsing history data belonging to other users across different sessions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** Cross-site request forgery occurs when an attacker tricks a user's browser into performing an unwanted action on a different website where the user is authenticated. This issue affects the 'wan config set cgi', 'wan num set cgi', and 'lan ip change cgi' endpoints, allowing attackers to craft forged requests that trick authenticated administrators into modifying WAN or LAN network configuration settings without consent. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** An information disclosure issue exists in the 'ddns wan list show.cgi' endpoint and the `DDNSset cgi`, `IGD GetCgiHandler`, and `IGD CgiCall` components. An attacker accessing this CGI handler can retrieve plaintext DDNS credentials, leading to the exposure of sensitive account information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the 'ddns wan list show.cgi' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A stored cross-site scripting issue exists in the 'ddns wan list show.cgi' endpoint. The flaw is caused by the unsafe use of the `eval()` function when handling DDNS data. An attacker can inject a malicious script through the DDNS configuration path, which results in the persistent execution of the script whenever the affected page is accessed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A sensitive information disclosure issue exists in the 'user pass show.cgi' component. Low-privilege attackers can exploit this flaw using `ui config 2.xml` and `misc.js` to disclose router credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A stack-based buffer overflow exists in the 'wake up set.cgi' endpoint. This issue is caused by unbounded tokenization of the `MAC` and `ID` input variables. An attacker can provide specially crafted values for these variables to overflow the stack buffer and corrupt program memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the 'wake up set.cgi' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A stack-based buffer overflow exists in the 'ntools tcpdump start set.cgi' endpoint. This issue is caused by an unsized sprintf call when processing form values, which allows an attacker to submit crafted input to overflow the stack buffer and potentially execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** An OS command argument injection flaw exists in the Nettools tcpdump launch paths. This issue affects the `ntools start set cgi`, `ntools tcpdump start set cgi`, `exe default`, and `ntools proc` components. Attackers can inject crafted arguments into these routines to manipulate system commands executed on the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** An issue exists in the handling of `plan.json` within the `mod qos bandwidth` component, specifically inside `filter conns dump cgi.c` and `IGD CgiCall.c`. Authenticated users with broad roles can access QoS read routes to obtain live network telemetry, exceeding their intended privilege level. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NR255-V version 1.5.130703 **Description** Stored Cross-Site Scripting occurs because the software fails to sanitize QoS rule names before they are parsed using the `eval()` function. This issue affects the `qos xianz add cgi`, `qos xianz show cgi`, `qos filter add cgi`, and `qos filter show cgi` handlers. An attacker can inject persistent script code through a crafted QoS rule name that executes when the stored data is processed by these handlers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A null pointer dereference occurs in the QoS setter CGI handlers `filter conn del cgi.c` and `gre prio set cgi.c` because the results of the `atoi()` function are not checked. An attacker can cause a denial of service by providing specially crafted input to these handlers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** OS command argument injection occurs because the system builds root-run command lines using unquoted user-supplied DDNS input within the `DDNSset cgi.c` and `ddns Proc.c` components. Attackers can use unsanitized parameters to inject additional command arguments that are executed with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A stored cross-site scripting issue exists within the routing and NAT configuration CGI components. Attackers can inject persistent script payloads through the route and NAT configuration pages, which are then executed in the context of users viewing the affected pages. The affected CGI components include `routing tab add cgi`, `routing table list show cgi`, `route policy add cgi`, and `route policy parame show cgi`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A null pointer dereference occurs in the 'route policy add.cgi' endpoint when the `exit port` parameter is missing. A null pointer dereference is a condition where a program attempts to read or write to a memory address that is null, typically causing the application to crash. An attacker can trigger this by sending requests without the `exit port` field, leading to a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `exit port` parameter in the 'route policy add.cgi' endpoint until the issue is resolved.