Critical CVSS 9.3: Unauthenticated Stack Overflow in Netcore NR256CN Routers Enables Remote Code Execution
Unauthenticated attackers can exploit a stack overflow in Netcore NR256CN routers running up to version 1.5.140116 to crash services or run code.
Key points
- The vulnerability is rated critical with a CVSS score of 9.3 by the National Vulnerability Database.
- The flaw exists in the Boa web server component within the router's firmware.
- The source material does not confirm the availability of a patch or fix.
Netcore NR256CN routers running firmware versions through 1.5.140116 are affected by a critical security flaw. The vulnerability allows unauthenticated attackers to execute code or crash the system. The issue resides in the Boa web server software embedded in the device firmware. Security researchers have identified the risk as severe due to the lack of authentication required for exploitation.
How it unfolded
- The National Vulnerability Database recorded the issue as CVE-2026-111711.
- The flaw was identified in the user_ok() function of the Boa web server.
- Analysis revealed the function uses unbounded strcpy() calls for username handling.
Who is affected
The vulnerability specifically impacts Netcore NR256CN routers. Any device running firmware version 1.5.140116 or earlier is susceptible to the attack. The flaw is located in the Boa web server component that handles user authentication requests. Attackers do not need valid credentials to trigger the vulnerability. They can target any protected router CGI route to initiate the attack.
The technical root cause involves a stack overflow in the Boa server. The user_ok() function copies Basic-auth usernames into a 64-byte stack buffer. It uses the strcpy() function, which does not check string length limits. This allows an attacker to send a username longer than 63 bytes. The excess data overflows the buffer, crashing the main Boa process or enabling code execution.
Our take on the response
The severity rating of 9.3 reflects the ease of exploitation and high impact. The lack of authentication makes the risk immediate for exposed devices. The use of a basic web server function like strcpy() highlights legacy coding risks. Organizations must treat this as a high-priority incident. The source material does not state whether a fix is available.
Who needs to act first
Teams should prioritize isolating Netcore NR256CN routers from public networks immediately. Check whether these devices are accessible from the internet and restrict access. Implement network segmentation to limit exposure to untrusted zones. Monitor firewall logs for unusual traffic patterns targeting router CGI routes. Prepare to apply vendor updates as soon as they become available. Ensure configuration backups exist before making changes.
What to do and how to stay safe: Netcore
- Restrict internet access to Netcore NR256CN router management interfaces.
- Monitor network logs for attempts to access protected CGI routes.
- Verify firmware versions on all Netcore devices to confirm exposure.
- Isolate affected routers from critical internal network segments.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-111711 as critical with a CVSS score of 9.3.
Does this vulnerability require authentication to exploit?
No, the vulnerability is pre-authentication, meaning attackers do not need valid credentials.
Is there a patch available for this issue?
The source material does not confirm the availability of a patch or fix.
