CVE-2026-111711: Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's userok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/.cgi route to crash the main Boa process or potentially execute code.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Netcore NR256CN devices running firmware through 1.5.140116 are affected when their Boa web server exposes protected /router/*.cgi routes. Because exploitation is network-based and requires no authentication, any reachable affected web management interface is potentially exposed.
What does an attacker need to exploit it?
An attacker only needs network access to the Boa web server and the ability to send a Basic Authentication username longer than 63 bytes to a protected /router/*.cgi route. No valid credentials or user interaction are required.
What is the likely impact of exploitation?
A crafted overlong username can crash the main Boa process. The vulnerability may also allow code execution, with high impact to confidentiality, integrity, and availability.
How can I determine whether a device is affected?
Identify Netcore NR256CN devices and check whether their firmware version is 1.5.140116 or earlier. Confirm whether protected /router/*.cgi endpoints are reachable through the device's Boa web interface.