Netcore NR255‑V version 1.5.130703 contains a stack‑based buffer overflow in the ntools_tcpdump_start_set.cgi handler. An unsized sprintf call processes form data without limit, allowing an attacker to submit crafted input that overflows the stack buffer and can lead to arbitrary code execution on the device. The vulnerability directly compromises the confidentiality, integrity, and availability of the router by permitting remote code execution.

The affected system is the Netcore NR255‑V router running firmware 1.5.130703. No other versions or products were listed in the CNA affected‑version data; therefore only this exact build is confirmed vulnerable.

The CVSS score of 8.7 classifies the flaw as High severity, and an EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote; an unauthenticated attacker can send an HTTP request to the ntools_tcpdump_start_set.cgi endpoint with crafted form data, triggering the overflow without needing prior access credentials. The combination of a high severity rating and the ease of remote exploitation makes it a notable risk for exposed or unprotected Netcore routers.