CVE-2026-111710: Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's userauth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/getusertype.cgi to kill the main Boa process and deny management interface access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker who can reach the router's Boa web management server can trigger the crash. No valid credentials or user interaction are required.
What request is needed to trigger the denial of service?
The attacker sends a malformed Basic Authorization header to a protected route, such as /router/get_user_type.cgi. A value that decodes without a colon, including a single-character value, can cause user_auth() to dereference a NULL pointer.
What is the operational impact of successful exploitation?
The malformed request kills the main Boa process, denying access to the router management interface. The provided information describes availability impact only; it does not indicate confidentiality or integrity impact.