{"id":"CVE-2026-111711","published":"2026-10-16T18:17:55.337","lastModified":"2026-10-16T22:17:23.053","description":"Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-basic-auth-stack-overflow.md","tags":[]},{"url":"https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-pre-auth-stack-overflow-via-boa-user-ok","tags":[]}],"exploitRefs":[{"url":"https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-basic-auth-stack-overflow.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A stack overflow vulnerability exists in Netcore NR256CN routers' Boa web server that allows unauthenticated attackers to crash the system or potentially execute code by sending overly long usernames during Basic authentication. This affects all protected CGI routes and can lead to complete system compromise.","exploitability":"Exploitation is relatively straightforward requiring only a single HTTP request with a username longer than 63 bytes to any protected /router/*.cgi endpoint, with no authentication required.","blast_radius":"The vulnerability affects all Netcore NR256CN routers running firmware versions through 1.5.140116, potentially impacting thousands of devices in enterprise and residential networks that rely on these routers for connectivity.","remediation":"Upgrade to firmware version 1.5.140117 or later immediately, as this is the first fixed version specifically mentioned in the CVE description.","detection":"Monitor for HTTP requests containing Basic-auth headers with usernames exceeding 63 bytes to /router/*.cgi endpoints in web server logs, particularly looking for repeated connection resets or process crashes in the Boa web server process.","tags":["rce","web","stack-overflow","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:47:29.578Z"}}