[CVE-2026-76870] Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in the mtd_write pre…

Descripción técnica

Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in the mtd_write pre-flash validation routine triggered by short firmware uploads. Attackers can upload a truncated firmware image via put_file_cgi.c to trigger out-of-bounds reads across main.c, check_image_uuid.c, and oemMD5Update.c.

Puntuación CVSS

Score: 7.1/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Debilidades (CWE)

CWE-125

Fuente oficial

Publicado en NIST NVD.