CVE-2026-76071: Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter
Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in netis.cgi. Attackers can exploit widthless sscanf conversions that copy user-supplied input into fixed-size stack buffers before authentication is verified, achieving remote code execution as root due to the Boa web server executing the CGI environment with root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netis NC63to a version that resolves this vulnerability.Fixed in V3.0.0.3327 - Compensating control
Block unauthenticated access to the Netis NC63 CGI endpoint (netis.cgi) that processes the ipFilterList=mod action and the destHost parameter until the device is updated to a non-vulnerable firmware.
Event History
Frequently Asked Questions
Which systems are in scope?
Netis NC63 firmware through version V3.0.0.3327 is affected. No fixed version is identified in the available data.
Does exploitation require credentials or user interaction?
No. An unauthenticated remote attacker can reach the vulnerable CGI action over the network, with no user interaction required.
What level of access could an attacker obtain?
Successful exploitation can result in remote code execution as root, because the Boa web server runs the CGI environment with root privileges.