Netcore NR255‑V firmware 1.5.130703 has a web‑based component that unintentionally returns DDNS credentials in clear text. This allows a user who can reach the ddns_wan_list_show.cgi handler to read private account usernames and passwords, exposing sensitive account information that can be leveraged for further compromise. The weakness is classified as CWE‑522, Sensitive Information Exposure, and is rated with a CVSS score of 7.1, indicating a high severity impact on confidentiality. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the disclosed credentials could enable attackers to hijack DDNS services or access the router’s back‑end. The existential threat originates from injection of credentials into publicly served responses, meaning an attacker can read them while the router is actively serving requests.

Netcore routers running NR255‑V firmware version 1.5.130703 are affected. No prior or later firmware revisions are mentioned in the advisory. Administrators should verify they are operating on this specific build and assess whether any older or unpatched devices remain in the network.

The CVSS score of 7.1 indicates a significant risk to confidentiality in a scenario where attackers can reach the vulnerable CGI endpoint. The EPSS score of <1% suggests low probability of exploitation at present, and the vulnerability is not listed in KEV, implying no known widespread exploitation yet. However, the risk remains because once an attacker gains access to the CGI handler—likely through local network or remote web interface access—the credential disclosure is straightforward. The exploit requires the attacker to navigate to the ddns_wan_list_show.cgi path, which is typically a direct URL on the router’s web administration interface. This inference assumes that the router exposes its web interface over HTTP/HTTPS without additional authentication barriers, a common default configuration that enables local attackers to obtain credentials without needing elevated privileges.