Full Router Control: Netcore NR256CN Critical Flaw Allows Unauthenticated Access Without Passwords
Unauthenticated attackers can exploit a stack overflow in Netcore NR256CN devices, potentially taking full control of the router without needing a password.
Key points
- The vulnerability affects Netcore NR256CN routers running firmware up to version 1.5.140116.
- The National Vulnerability Database rates the flaw as critical with a CVSS score of 9.3.
- Attackers do not need login credentials to trigger the issue on protected router pages.
Netcore NR256CN routers contain a serious security flaw that allows anyone on the internet to potentially take control of the device. This vulnerability exists in the web server software used to manage the router settings. Because the flaw does not require authentication, attackers can exploit it from outside the local network without knowing any passwords or usernames.
The issue stems from how the Boa web server processes login attempts. When a user tries to access protected router pages, the server copies the entered username into a small memory space. If the username is too long, it overflows this space. According to the NVD record, this stack overflow allows unauthenticated attackers to crash the server or execute arbitrary code on the device.
What we know
The National Vulnerability Database identifies this issue as CVE-2026-111711. It affects Netcore NR256CN models running firmware versions through 1.5.140116. The vulnerability is located in the `user_ok()` function of the embedded Boa web server. The server uses an unsafe copying method for Basic-auth usernames. It writes these strings into 64-byte stack buffers without checking the length.
An attacker can send a username longer than 63 bytes to any route ending in `/router/*.cgi`. This action targets the main Boa process. The result is either a crash of the web server or the execution of attacker-controlled code. The NVD assigns a CVSS score of 9.3, classifying the severity as critical. The weakness is categorised under CWE-121, which covers stack-based buffer overflows.
Defender's checklist
- Identify all Netcore NR256CN routers currently deployed in your environment.
- Check the firmware version on each device to see if it is 1.5.140116 or earlier.
- Determine if these routers are directly accessible from the internet or exposed via port forwarding.
- Review logs for unusual traffic targeting CGI routes or repeated connection failures.
The background in plain language
A stack overflow occurs when a program writes more data into a memory area than it can hold. Imagine pouring a large bucket of water into a small cup; the excess spills over into neighbouring areas. In software, this spillage can overwrite critical instructions, causing the program to crash or run malicious code. Basic authentication is a simple method where a browser sends a username and password with every request.
If the server handling these requests does not check the length of the username, an attacker can send an excessively long name to trigger this overflow. Teams usually isolate management interfaces to prevent external access. Checking whether web services are exposed to the public internet is a standard security practice. This reduces the risk of unauthenticated attackers reaching vulnerable functions. Organisations should verify that administrative ports are not open to unknown users.
What to do and how to stay safe: Netcore
- Restrict access to router management interfaces so they are only reachable from the internal local network, not the public internet.
- Monitor network traffic for unusually large HTTP requests or repeated attempts to access CGI scripts on the router.
- Contact the vendor to inquire about the availability of a firmware update that addresses the stack overflow vulnerability.
- Implement network segmentation to ensure that compromised devices cannot easily communicate with other sensitive systems on the network.
Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Netcore router models are affected by this vulnerability?
The Netcore NR256CN router is affected, specifically those running firmware versions up to and including 1.5.140116.
Do attackers need a password to exploit this flaw?
No, the vulnerability is pre-authentication, meaning attackers can exploit it without needing valid login credentials or passwords.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-111711 as critical with a CVSS score of 9.3.
