CVE-2026-76070: Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter
Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi. Attackers can exploit the custom Base64 decoder's lack of output length validation against the fixed-size stack buffer to achieve remote code execution with root privileges, as the Boa web server executes the CGI environment as root.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Netis NC63 devices running firmware through V3.0.0.3327 are affected. Exposure is greatest where the device's Boa web interface is reachable remotely, because exploitation targets the login handler over the network.
Does an attacker need credentials or user interaction to exploit it?
No. The vulnerability is exploitable by an unauthenticated remote attacker, and no user interaction is required.
What level of access could successful exploitation provide?
Successful exploitation can result in remote code execution with root privileges. The affected CGI environment is executed by the Boa web server as root.
What input triggers the overflow?
An attacker submits an oversized Base64-encoded password to the login handler in /bin/netis.cgi. The custom Base64 decoder does not validate decoded output length before writing to a fixed-size stack buffer.