Netcore NR255-V firmware version 1.5.130703 contains a null pointer dereference flaw in the route_policy_add CGI script. When an HTTP request omits the exit_port parameter, the script dereferences a null pointer, causing the process to crash. The crash results in a temporary loss of routing functionality, disabling the router from adding or modifying routes and effectively denying network services.

The vulnerability is present exclusively in Netcore NR255-V routers that run firmware 1.5.130703. No other firmware releases are listed as affected in the CVE record, but administrators should verify that they are not running any other versions that may have similar code paths.

The CVSS score of 6.9 classifies this issue as medium severity. The EPSS score is reported as less than 1 %, suggesting that exploitation attempts are currently rare. The flaw is not catalogued in CISA’s KEV list, indicating no known active exploits. Based on the description, it is inferred that attackers can trigger the crash by sending HTTP requests that miss the exit_port field to the exposed route_policy_add endpoint, a step that is likely achievable from any host with network connectivity to the device; no authentication or privileged access is required.