Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Netcore NR256CN can crash or be hijacked with long usernames

CVE-2026-111711 · published 19 days ago
Summary

The web server built into Netcore NR256CN devices accepts a username without checking its length. An attacker who is not logged in can send a very long username to any /router/*.cgi page, causing the server to stop working or possibly run malicious code. Update the device to the latest firmware or apply the vendor’s patch, and consider restarting the device if you notice crashes.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
netcore nr256cn <= 1.5.140116
Original advisory text
Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published16 Oct 2026
Updated4 Nov 2026
First seen16 Oct 2026
Sources
CVE-2026-111711 · NVD
CVE-2026-111711 · MITRE
Track software like this
Free during beta