CVE-2026-111710
Summary
by MITRE • 10/16/2026
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
Xxx Xxxxxxxxxxxxx Xxxxxxxxxx Xx Xxxxxxx Xxxxxxx Xxxxxxx Xxxxxxx Xxxxxxxx Xxxxxxxx Xxxxxxx X.x.xxxxxx Xxxxxxxxxx X Xxxxxxxx Xxxxxxxx Xxxx Xxxxxx Xxx Xxxxxxxx Xxx Xxxxxx Xxxxxxxxxxxxxx, Xxxxxxxxxxxx Xxxxxxxxx Xxx Xxx Xxxxxxxxxxx Xxxxx. Xxxx Xxxxxx Xx Xxxxxxxx Xxxxxxxx Xx X Xxxxxxxxxxx Xxxxxxx Xx Xxxxxx, Xxxxxx Xx X Xxxxxxxx Xxxxxx Xxx Xxxxxxxxx Xxxxxxxx Xxx Xxxxxxxxxxxx Xx Xxxxxx Xxxxxx Xxxxxxx Xx Xxxxxxx Xxxxxxx Xxxxxxxx Xx Xxxx Xxxxxxxxxxxx Xxxxxx. Xxx Xxxx Xx Xxx Xxxxx Xxxx Xx Xxx Xxxx_xxxx() Xxxxxxxx Xxxxxxxxxxx Xxx Xxxxxxx Xxxx Xxxxxxxxxxxxxx Xxxxxxx. Xxxx Xx Xxxxxxxxxxxxxxx Xxxxxxxx Xxxxxxxxx Xxxx Xxxxxxxxx Xxxxxxxxxxxxxx Xxxxxxxxx Xxxx Xx /xxxxxx/xxx_xxxx_xxxx.xxx, Xxxx Xxx Xxxxxxx Xxxx Xxxxxxxxxxxxx Xx Xxxxxxxxxx X Xxxxxxxxxxxx Xxxxxxx Xxxxxxxxxxxxx Xxxxxx. Xxxxxx Xxxxxxxx Xxxxx Xxxxxxxxxxxxxx Xxxxx Xxxxxxxx X Xxxxxx-xxxxxxx Xxxxxx Xxxxxxxxxx Xxxx Xxxxxxxx Xxx Xxxxxxxx Xxxxxxxxx Xx X Xxxxx Xxxxxxxxx, Xxx Xxxxxxxxxx Xxxxxxxxxxxxxx Xxxxx Xx Xxxxxxxx Xxx Xxxxxxxxx Xx Xxx Xxxxx Xxxxxx Xxxxxxxxxx Xx Xxxxxxx Xx Xxx Xxxxxxxxxx Xxxxxxxxxx.
Xxxx X Xxxxxxxxx Xxxxxxxxxxx, Xxx Xxxx Xxxxx Xx Xxxxxxxxxx Xx Xxx-xxx, Xxxx Xxxxxxx Xxxxxxxxxxx. Xxx Xxx Xxx Xxxxxx Xxxxxxx Xxx Xxxxxxxxxxxxx Xxxxxx Xxxxx Xx Xxxxxx Xxx Xxx Xxxx Xxxxxxxx Xxxxxx, Xxxxx Xxxxxxxx Xxxx Xxxxx Xxxxxxxxxxx Xxxx Xx Xxxxxxx Xx Xxxxxx(xxxxxxxx:xxxxxxxx). Xxxx Xx Xxxxxxxx Xxxxxxxx X Xxxxxxxxx Xxxxxx Xxxx Xxxxxxx Xx Xxxx X Xxxxxx Xxxxxxxxx Xx Xxxxx Xxx Xxxxxxxx Xxxxxxxxx, Xxx Xxxxxxxx Xxxxxxx Xxxxx Xxxxxxxx Xx Xxxxxx Xxxxxx Xxxxxxxxx Xxxxxxxxxx Xxxx Xxx-xxxxxxxx Xxxxxxxx Xx Xxxxxxxx Xxxxxx. Xxxxxxx Xxxxx Xxxxxxxx Xxx Xxx Xxxxxxxxxxx Xx Xxxxxxx Xxx Xxxxxxx Xxxxxx Xxx, Xxx Xxxxxxxxxxx Xxxxxxxx Xx Xxxxxxxxxxx X Xxxx Xxxxxxx. Xxxx Xxxxxxxxx Xxxxxxxx Xxxxxxxx Xxxxxx Xxxxxx Xxxxxxxxx Xxx Xxxxxxx Xx Xx Xxxxxxxxx Xxxxxxxxxxxx Xxxxx Xxxxxx Xxx Xxxxxxx Xxxxx Xx Xxx Xxx Xxxxxx.
Xxx Xxxxxxxxxxx Xxxxxx Xx Xxxx Xxxxxxxxxxxxx Xx Xxxxxx Xxx Xx Xxx Xxxxxxxxx Xxx Xxxxxx Xx Xxxxxxx Xxxxxxx Xxxxxxxx Xxxxxxx Xxxxxxxxxxxxxx. Xxxxx Xxx Xxxx Xxxxxx Xxx Xxxx Xxx Xxxxxxx Xx Xxxxx, Xxx Xxxxxxxxxx Xxxxxxxxx Xxxxxx Xx Xxx Xxxxxx Xxxxxxx Xxxxxxxxxx Xxxxxxxxxxxx. Xxx X Xxxxxxxxxxx Xxxxxxx Xx Xxxxxx, Xxxx Xxxxxxxxxxx Xxxxxx Xxx Xxxxxxxxxxxxxx Xxxxxx Xxxxx, Xxxxxxxxxx Xxxxxxxxxx Xxxxx Xxxx Xxxxxxxxxxx Xxxxxxx Xxxxxxxx, Xxxxxxxx Xxxxxxxxx Xxxxxxx, Xx Xxxxxxxx Xxxxxxxx. Xxxxx Xxx Xxxxxxx Xxxxxx Xxxxxxxx Xx Xxxxxxxxxxxx Xxxx Xxxxxxx Xxxxxxx Xxxxxxxxxx, Xxxx Xxxxxxx Xxx Xxxxxxxxx Xx Xxxxxxxxx Xx Xxxx Xx Xxxx Xxxxxxx Xxxxxx Xxxxxx Xx Xxxxxx Xxxxxxxxxxxxxx Xxxxxxxxxx Xxxxxxxx Xx Xxx Xxxxxx Xxxxxxxx Xxxxxxx Xxxxxx Xxxxx Xxxxxxxx Xx Xxxxxxxx Xxxxxx Xxxxxxx Xx Xxxxxxx Xx Xxxxxxxx Xxxxxxxxxxxx.
Xxxx Xxxxxxxxxxxxx Xxxxxx Xxxx Xxxxx Xxx&xx Xxxxxxxxx Xxxxx, Xxxxxxx Xxxxxx Xx Xxxxxxx, Xxxxxxxxxxxx Xxxxx Xxx Xxx-xxxxxxxxx Xx Xxxxxxxx Xxxxxxxxxx Xxx Xxxxx. Xxxxxxxxx Xxx Xxxxxxx Xxxx Xxxx Xxxxxxxx Xxxx Xxxx Xxxxxxx Xxxxxxxxx Xxx Xxxxx Xxxxxxxxxxxxxx Xxxxxxxxxxx, Xxxxxx Xx X Xxxx-xxxx Xxxxxx Xxx Xxxxxxxxx Xxxxxxx Xxxxxxxxx Xxx Xxx Xxxxxxxxxx Xxxxxxxxx. Xxx Xxxxxxx Xx Xxxxx Xxx Xxx Xxxxxx Xxxx Xx Xxxxxxxxxxxxxxx Xxxxx Xxxxxxxxxxxxx Xxxxxx Xxx Xxxxxxx Xx Xxxxx Xxx Xxxxxxxxx Xxxxxx Xxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxxx Xx Xxxxxx Xxxxxxxxxx Xxxx Xxxxx Xxxxxxxxxx Xxxxxxx Xxxxxxxxxxxx Xxxxxxxx Xxxxxx Xxxxxx Xxxxxxxx.
Xxxxxxxxxx Xxxxxxxxxx Xxxx Xxxxx Xx Xxxxxxxxx Xxxxxxxx Xxx Xxxxxxxxx Xxxxxxxxxxxxx Xxxxxxx. Xxxxx Xx Xxxxxxx Xxxxxxx Xxxxxxx Xxxxxx Xxxxxx Xxxxx Xxxxxxxx Xx Xxxxxxx X.x.xxxxxx Xx Xxxxx, Xxxxx Xxx Xxxxxx Xxx Xxxxxxxxxxx Xxxxxx Xxxxx Xxxxxxxxxx Xxxxxx Xxx Xxxx_xxxx() Xxxxxxxx Xx Xxxxxx Xxxx Xxxxxxxxxxxxx Xxxxxxx Xxxxxxx Xx Xxxxxxxx Xxxxxxx Xxxxxx Xxxxxxxxxx. Xx Xxxxxxxxxxxx Xxxxx Xxxxxxxxx Xxxxxxxx Xx Xxx Xxxxxxxx, Xxxxxxx-xxxxx Xxxxxxxx Xxxx Xx Xxx Xxxxxxxxxxx Xxxxxxxxx Xxx Xx Xxxxxxxxxx Xx Xxxxxxx Xxxx Xxxxxxxx Xxx Xxxxx Xxxxxxxxx Xxxxxxxxxxxxxx Xxxxxxx Xxxxxxxxxx Xxxxxxx Xxxxxx Xxxxxxxxxx Xx Xxxxxxx Xxxxxxxxxx. Xxxxxxxxxxxx, Xxxxxxxxxxx Xxxxxx Xx Xxxxxxxxxxxxxx Xxxxxxxxxx Xxx Xx Xxxxxxxxxxxx Xxxxxxx Xxx Xxxxxx Xxxxxxx Xx Xxxxxxxx Xxxxxxxx Xx Xxxxxxxxx Xxxxxxxx. Xxxxxxx Xxxxxxxxxx Xx Xxxxxx Xxxx Xxx Xxxxxxxx Xxx Xxxxxxxx Xxxxxx Xxxxx Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxxxxxxx Xxxxxxxxx Xxx Xxxx Xxx Xx Xxxxxxxxx Xxxxxx Xxxxxxxxxxxx Xxxxxxxx.