CVE-2026-111711 in NR256CN
Summary
by MITRE • 10/16/2026
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Netcore NR256CN devices running firmware versions through 1.5.140116 represents a critical security flaw within the embedded web server infrastructure, specifically affecting the Boa application. This device is commonly deployed as a residential gateway or router, making it a frequent target for automated attacks and remote exploitation attempts on the public internet. The core of the issue lies in the implementation of the user_ok() function, which serves as an authentication gatekeeper for protected administrative interfaces accessed via specific CGI scripts located under the /router/ path. This function is responsible for validating credentials provided through HTTP Basic Authentication headers before granting access to sensitive configuration pages or management tools.
The technical root cause of this vulnerability is a classic stack-based buffer overflow resulting from improper input validation and unsafe memory handling practices by the software developers. When processing authentication requests, the user_ok() function utilizes unbounded strcpy() calls to copy username strings extracted from Basic-auth headers into fixed-size buffers allocated on the program's call stack. These destination buffers are strictly limited to sixty-four bytes in size. However, there is no corresponding length check or boundary validation performed on the incoming username data before the copy operation occurs. This design oversight allows an attacker to supply a username string that exceeds the buffer capacity, directly leading to memory corruption as excess characters overwrite adjacent stack memory locations including return addresses and saved frame pointers.
From an operational perspective, this flaw has severe implications for device availability and integrity. Because the vulnerability exists in a pre-authentication context, it can be triggered by unauthenticated remote attackers without requiring any prior knowledge of valid credentials or session tokens. By sending a specially crafted HTTP request with an oversized username to any protected CGI endpoint within the /router/ directory structure, an attacker can induce a stack overflow that crashes the main Boa web server process. This denial-of-service condition effectively locks out legitimate administrators from managing their network infrastructure and disrupts connectivity for end-users relying on the device. Beyond simple service disruption, the nature of stack-based overflows creates a high-risk vector for arbitrary code execution if an attacker can precisely control the overwritten return address to redirect program flow to malicious shellcode injected via the same request buffer or adjacent memory regions.
This vulnerability aligns with Common Weakness Enumeration category CWE-120, which classifies buffer copies without checking size limits as a fundamental software defect leading to overflow conditions. Furthermore, in the context of the MITRE ATT&CK framework for enterprise security, this flaw facilitates initial access and potential privilege escalation through techniques associated with remote code execution via exploited components or injection attacks against web applications. The lack of input sanitization at the authentication layer highlights a critical gap in secure coding practices typical of many embedded IoT devices where resource constraints often lead to simplified but insecure implementations.
Mitigation strategies for this vulnerability primarily involve applying vendor-provided firmware updates that patch the user_ok() function with proper bounds checking or replace unsafe string handling functions like strcpy() with safer alternatives such as strncpy() or strlcpy(). Until patches are available, network administrators should restrict access to the device's management interface by placing it behind a firewall rule set that limits exposure only to trusted internal IP addresses. Additionally, disabling remote administration features where not strictly necessary reduces the attack surface presented to external networks. Security monitoring tools can also be configured to detect anomalous HTTP requests containing unusually long username fields targeting CGI endpoints as an indicator of potential exploitation attempts.