Jiang Yuxuan

**Name of the Vulnerable Software and Affected Versions** Netcore NR268 version 1.7.121109 **Description** An improper integrity verification flaw exists in `mtd write`, which allows for forged firmware authenticity checks. Attackers can exploit the 'put file.cgi' endpoint and the `check image uuid.c` file to bypass firmware signature validation and load unauthorized firmware images. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR268 version 1.7.121109 **Description** An issue exists in the restore archive prefix validation within the 'parame put file.cgi' endpoint. Attackers can exploit a flawed prefix check in the `put parame file cgi.c` file to bypass restricted restore archive handling. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** An issue exists in the handling of captive-portal credentials. An attacker can query the 'l7 web auth user show.cgi' endpoint to obtain captive-portal user credentials, which compromises the confidentiality of authenticated network access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** Sensitive information disclosure exists in the audit endpoints handled by `l7 web auth log dump cgi.c`, `audit get cgi.c`, and `mod dispatch auth/plan.json`. Attackers can query these components to obtain session and browsing history data belonging to other users across different sessions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** Cross-site request forgery occurs when an attacker tricks a user's browser into performing an unwanted action on a different website where the user is authenticated. This issue affects the 'wan config set cgi', 'wan num set cgi', and 'lan ip change cgi' endpoints, allowing attackers to craft forged requests that trick authenticated administrators into modifying WAN or LAN network configuration settings without consent. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** An information disclosure issue exists in the 'ddns wan list show.cgi' endpoint and the `DDNSset cgi`, `IGD GetCgiHandler`, and `IGD CgiCall` components. An attacker accessing this CGI handler can retrieve plaintext DDNS credentials, leading to the exposure of sensitive account information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the 'ddns wan list show.cgi' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A stored cross-site scripting issue exists in the 'ddns wan list show.cgi' endpoint. The flaw is caused by the unsafe use of the `eval()` function when handling DDNS data. An attacker can inject a malicious script through the DDNS configuration path, which results in the persistent execution of the script whenever the affected page is accessed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A sensitive information disclosure issue exists in the 'user pass show.cgi' component. Low-privilege attackers can exploit this flaw using `ui config 2.xml` and `misc.js` to disclose router credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A stack-based buffer overflow exists in the 'wake up set.cgi' endpoint. This issue is caused by unbounded tokenization of the `MAC` and `ID` input variables. An attacker can provide specially crafted values for these variables to overflow the stack buffer and corrupt program memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the 'wake up set.cgi' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A stack-based buffer overflow exists in the 'ntools tcpdump start set.cgi' endpoint. This issue is caused by an unsized sprintf call when processing form values, which allows an attacker to submit crafted input to overflow the stack buffer and potentially execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** An OS command argument injection flaw exists in the Nettools tcpdump launch paths. This issue affects the `ntools start set cgi`, `ntools tcpdump start set cgi`, `exe default`, and `ntools proc` components. Attackers can inject crafted arguments into these routines to manipulate system commands executed on the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** An issue exists in the handling of `plan.json` within the `mod qos bandwidth` component, specifically inside `filter conns dump cgi.c` and `IGD CgiCall.c`. Authenticated users with broad roles can access QoS read routes to obtain live network telemetry, exceeding their intended privilege level. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NR255-V version 1.5.130703 **Description** Stored Cross-Site Scripting occurs because the software fails to sanitize QoS rule names before they are parsed using the `eval()` function. This issue affects the `qos xianz add cgi`, `qos xianz show cgi`, `qos filter add cgi`, and `qos filter show cgi` handlers. An attacker can inject persistent script code through a crafted QoS rule name that executes when the stored data is processed by these handlers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A null pointer dereference occurs in the QoS setter CGI handlers `filter conn del cgi.c` and `gre prio set cgi.c` because the results of the `atoi()` function are not checked. An attacker can cause a denial of service by providing specially crafted input to these handlers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** OS command argument injection occurs because the system builds root-run command lines using unquoted user-supplied DDNS input within the `DDNSset cgi.c` and `ddns Proc.c` components. Attackers can use unsanitized parameters to inject additional command arguments that are executed with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A stored cross-site scripting issue exists within the routing and NAT configuration CGI components. Attackers can inject persistent script payloads through the route and NAT configuration pages, which are then executed in the context of users viewing the affected pages. The affected CGI components include `routing tab add cgi`, `routing table list show cgi`, `route policy add cgi`, and `route policy parame show cgi`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A null pointer dereference occurs in the 'route policy add.cgi' endpoint when the `exit port` parameter is missing. A null pointer dereference is a condition where a program attempts to read or write to a memory address that is null, typically causing the application to crash. An attacker can trigger this by sending requests without the `exit port` field, leading to a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `exit port` parameter in the 'route policy add.cgi' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** A stack-based buffer overflow exists due to improper sscanf token parsing. Attackers can exploit this by submitting crafted input to the 'reboot timer set.cgi' endpoint to corrupt stack memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** An out-of-bounds read occurs in the `mtd write` pre-flash validation routine when short firmware uploads are processed. An attacker can upload a truncated firmware image through the `put file cgi.c` endpoint to trigger out-of-bounds reads across `main.c`, `check image uuid.c`, and `oemMD5Update.c`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Netcore NR255-V version 1.5.130703 **Description** Sensitive information disclosure occurs through VPN read handlers. Attackers can exploit the endpoints 'mod vpn remote/plan.json', 'pptpd user show.cgi', 'pptp client config show.cgi', and 'l2tpd user show.cgi' to obtain PPTP (Point-to-Point Tunneling Protocol) and L2TP (Layer 2 Tunneling Protocol) VPN credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.