A high-severity stack-based buffer overflow in the Netcore NR255-V router allows authenticated attackers to execute arbitrary code via a crafted CGI request.

This vulnerability is a stack-based buffer overflow (CWE-121) triggered by an unsized sprintf operation within the ntools_tcpdump_start_set.cgi script. The vulnerability requires the attacker to have low-level privileges (authenticated) to interact with the target CGI endpoint.

The ability to execute arbitrary code on networking infrastructure poses a critical risk to business operations, as it allows attackers to gain full control over the router. This could lead to total network compromise, interception of internal traffic, or the establishment of a persistent foothold within the local environment. With a CVSS score of 8.8, this vulnerability represents a significant threat to confidentiality, integrity, and availability.

Immediate Action: Since no official patch is currently identified, administrators should restrict network access to the management interface of the Netcore NR255-V device to trusted management subnets only.

Proactive Monitoring: Monitor system logs for unauthorized access attempts to the ntools_tcpdump_start_set.cgi endpoint and watch for abnormal traffic patterns originating from the device.

Compensating Controls: Implement Web Application Firewall (WAF) or network-level access control lists (ACLs) to filter or block malicious input strings targeted at the vulnerable CGI parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced security research write-up.

Given the potential for complete device compromise, it is imperative that organizations treat this vulnerability with high priority. Even in the absence of an official vendor patch, immediate steps to isolate the management interface and monitor for suspicious activity are required to reduce the attack surface. Administrators should remain in contact with the vendor for formal firmware updates.