CVE-2026-111712
MediumCVSS 6.5Summary
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.
Risk Assessment
An unauthenticated attacker can access device management functions, potentially leading to full compromise of the device and network. This may result in configuration changes, data leakage, or use of the device for further attacks.
Recommendation
Update Netcore NR256CN software to a version later than 1.5.140116 if available. Until then, consider restricting access to the management interface from untrusted networks.
Other vulnerabilities in Netcore NR256CN
See all- CVE-2026-111710High
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.
- CVE-2026-111711Critical
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.
Original NVD description (English source)
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS