CVE-2026-111712 in NR256CN
Summary
by MITRE • 10/16/2026
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The Netcore NR256CN router, specifically versions through 1.5.140116, suffers from a critical authentication bypass vulnerability that fundamentally undermines the security architecture of its web-based management interface. This flaw allows unauthenticated attackers to access protected Common Gateway Interface (CGI) handlers by manipulating URI paths in a manner that exploits how the device's internal routing logic distinguishes between public and private resources. The core technical issue lies in the insufficient validation of request prefixes, which permits specific path structures to bypass authentication checks intended for administrative functions. By prefixing requests with routes such as l7_web_auth.cgi or standard image file extensions like .ico, an attacker can effectively trick the system into treating sensitive management commands as public-facing content, thereby granting access without valid credentials.
From a technical perspective, this vulnerability represents a classic case of improper authorization control where the application fails to enforce security policies consistently across all entry points. The presence of l7_web_auth.cgi in the bypass path suggests that even components explicitly designed for authentication handling can be manipulated or misinterpreted by the router's web server logic when accessed via specific URI patterns. Similarly, the use of .ico routes indicates a potential confusion between static asset serving and dynamic script execution, allowing attackers to piggyback on requests intended for non-interactive resources to trigger administrative actions. This behavior aligns with CWE-287, which describes Improper Authentication, as well as CWE-352, Cross-Site Request Forgery (CSRF), if the bypass can be triggered via maliciously crafted links or scripts from a victim's browser context. The vulnerability also maps to MITRE ATT&CK technique T1078, Valid Accounts, in the sense that it allows an attacker to operate with administrative privileges without possessing valid credentials, effectively achieving privilege escalation through path traversal logic flaws rather than credential theft.
The operational impact of this vulnerability is severe for network administrators and end-users relying on these devices for secure connectivity. An unauthenticated actor can gain full control over the router's configuration, potentially altering DNS settings to facilitate phishing or man-in-the-middle attacks, modifying firewall rules to expose internal networks to external threats, or extracting sensitive information such as Wi-Fi passwords and connected device details. This level of access compromises not only the integrity of the network infrastructure but also the confidentiality and availability of services hosted behind it. In enterprise environments, this could lead to lateral movement within a local area network, while in residential settings, it poses significant risks to personal privacy and data security.
Mitigation strategies must prioritize immediate patching by upgrading the Netcore NR256CN firmware to a version that resolves these routing logic flaws. If an update is not immediately available, administrators should implement strict access control lists (ACLs) on any intermediate firewalls or routers to restrict inbound traffic to management interfaces only from trusted IP addresses. Additionally, disabling remote management features where they are not strictly necessary reduces the attack surface significantly. Security monitoring tools should be configured to detect anomalous HTTP requests targeting CGI handlers with unusual URI prefixes, providing an early warning mechanism for potential exploitation attempts until a permanent software fix is deployed.