CVE-2026-112016: Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files
Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into /tmp/boatemp.update or /tmp/boatemp.para, tampering with pending firmware updates or configuration restores or causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Which devices are affected?
Netcore NR256CN devices running firmware through 1.5.140116 are affected. The issue is in the Boa-derived /bin/boa web server.
What access does an attacker need?
An attacker can exploit the issue remotely without authentication or user interaction. Exploitation involves sending a POST request to a non-existent .cgi pathname.
What can an attacker change?
The attacker can write controlled content to /tmp/boa_temp.update or /tmp/boa_temp.para. This can tamper with pending firmware-update or configuration-restore data, or cause denial of service.