The Netcore NR255-V router firmware version 1.5.130703 contains a stack-based buffer overflow in the reboot_timer_set.cgi script caused by improper parsing of arguments with sscanf. An attacker can send specially crafted input to trigger the overflow, potentially corrupting stack memory and enabling arbitrary code execution or denial of service. This flaw is classified under CWE‑121 and can compromise confidentiality, integrity, and availability if exploited.

The vulnerability affects the Netcore NR255‑V product line running firmware 1.5.130703. No other versions are listed. System administrators should identify units running this exact firmware and assess exposure.

The CVSS score of 8.6 indicates high severity. The EPSS score of < 1% indicates a low probability of exploitation at the present moment. The vulnerability is not listed in CISA KEV, suggesting no known active exploitation. The likely attack vector is network access to the router’s web interface, where an attacker would target the reboot_timer_set.cgi endpoint to supply malicious input. If triggered, stack corruption could allow arbitrary code execution, though that would require the attacker to achieve control of the device’s execution environment to gain further privileges.