CVE-2026-111712: Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7webauth.cgi or an .ico route to invoke protected management handlers without credentials.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Netcore NR256CN devices running firmware through 1.5.140116 are affected. Exploitation is network-based and does not require authentication or user interaction.
What does an attacker need to send to bypass authentication?
The attacker must request a protected management CGI handler using a URI prefixed with a public route. The described prefixes include l7_web_auth.cgi and an .ico route.
How can administrators check whether a device is vulnerable?
Review the device model and firmware version to determine whether it is a Netcore NR256CN running 1.5.140116 or earlier. Affected devices may allow protected management CGI handlers to be reached when their URI is prefixed with l7_web_auth.cgi or an .ico route.