CVE-2026-76862

Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launch paths, including ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, exe_default, and ntools_proc components. Attackers can inject crafted arguments into these tcpdump launch routines to manipulate executed system commands on the device.

  • Published Sep 15, 2026
  • CVSS 8.7 high
  • 0.5% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-76862 at the National Vulnerability Database