Netcore NR256CN Routers Face Critical Pre-Auth Stack Overflow in Boa Server

Unauthenticated attackers can exploit a critical stack overflow vulnerability in Netcore NR256CN routers to crash the main Boa web server process or potentially execute arbitrary code. The flaw, tracked as CVE-2026-111711, allows remote exploitation without requiring valid credentials on the device.

The National Vulnerability Database rates the issue as critical with a CVSS score of 9.3. The vulnerability stems from the Boa web server's user_ok() function, which handles Basic-authentication requests. According to the record, the function uses unbounded strcpy() calls to copy usernames into 64-byte stack buffers.

Technical Details of the Exploit

The core issue involves improper bounds checking during the authentication handshake. When a user attempts to access a protected route, the server processes the provided username. The implementation fails to verify the length of this input before copying it into a fixed-size memory location on the stack.

An attacker can trigger the overflow by sending a username that exceeds 63 bytes. This oversized input overflows the 64-byte buffer allocated for the username variable. The NVD record identifies this weakness as CWE-121, which refers to stack-based buffer overflows. This type of memory corruption can lead to unpredictable behavior, including process termination.

Beyond crashing the service, the overflow creates the potential for remote code execution. By carefully crafting the oversized username payload, an attacker may be able to overwrite return addresses or other control data on the stack. This could allow the injection and execution of malicious instructions within the context of the Boa process.

Scope of Affected Devices

The vulnerability affects Netcore NR256CN routers running firmware versions up to and including 1.5.140116. The record indicates that all versions through this specific build are vulnerable, implying that earlier releases are also at risk. No later patched version is mentioned in the provided source material.

The attack surface is specific to protected routes within the router's web interface. The flaw impacts any /router/*.cgi endpoint that requires authentication. Because the overflow occurs during the initial processing of the username, the attacker does not need to provide a correct password. The mere act of sending a malformed username to these endpoints is sufficient to trigger the vulnerability.

This pre-authentication nature of the flaw makes it particularly dangerous. Attackers do not need to bypass login screens or steal credentials to attempt an exploit. Any system on the network, or potentially remote systems if the router is exposed, can send the malicious request to the relevant CGI scripts.

What should you do?

Security teams should immediately inventory their environments to identify any Netcore NR256CN devices. Administrators should check the current firmware version against the vulnerable range ending at 1.5.140116. If the device is running an affected version, it is susceptible to the stack overflow described in CVE-2026-111711.

Since no fix has been confirmed in the source material, immediate mitigation is difficult. Organizations should restrict network access to the router's management interface. Blocking external traffic to the device's web ports can prevent remote attackers from reaching the vulnerable CGI routes.

Practical Steps for Mitigation

What to do and how to stay safe: Netcore

• Audit network devices to locate Netcore NR256CN routers and verify their firmware versions.
• Restrict access to the router's web management interface to trusted internal networks only.
• Monitor logs for unusual traffic patterns targeting /router/*.cgi endpoints or repeated connection failures.
• Isolate affected devices from untrusted networks until a vendor patch becomes available.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-111711?

The vulnerability has a CVSS score of 9.3, which is rated as critical severity.

Which Netcore firmware versions are affected by this flaw?

Netcore NR256CN routers running firmware versions through 1.5.140116 are affected by the vulnerability.

Can an attacker exploit this without a password?

Yes, the vulnerability is pre-authentication, allowing unauthenticated attackers to trigger the stack overflow using only a crafted username.