CVE-2026-111710
HighCVSS 7.5Summary
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.
Risk Assessment
An unauthenticated attacker can remotely cause the router management interface to become unavailable, preventing administration of the device.
Recommendation
Update Netcore NR256CN firmware to a version later than 1.5.140116 or apply the vendor fix if available.
Other vulnerabilities in Netcore NR256CN
See all- CVE-2026-111712Medium
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.
- CVE-2026-111711Critical
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.
Original NVD description (English source)
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS