CVE-2026-111711
9.8CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-121
Impact
Unauthenticated attackers can execute arbitrary code or crash the web server remotely by sending an overly long username in HTTP Basic auth. No prior access or user interaction is required.
Root cause
The Boa web server's user_ok() function copies HTTP Basic authentication usernames into a 64-byte stack buffer using an unbounded strcpy() call.
Affected systems
Netcore NR256CN router firmware through version 1.5.140116
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
No fixed firmware version is specified in the advisory; restrict or block external network access to the router's web management interface (/router/*.cgi) immediately.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.