CVE-2026-112016 in NR256CN
Summary
by MITRE • 10/18/2026
Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into /tmp/boa_temp.update or /tmp/boa_temp.para, tampering with pending firmware updates or configuration restores or causing denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in Netcore NR256CN devices running firmware versions through 1.5.140116 represents a critical security flaw within the embedded web server component known as Boa. This device, commonly deployed in residential and small office networking environments, relies on this CGI-based interface for remote management and configuration updates. The core technical deficiency lies in how the application handles HTTP POST requests directed at non-existent or malformed Common Gateway Interface pathnames. Instead of returning a standard error response indicating that the requested resource does not exist, the underlying Boa server implementation proceeds to process the request body under specific conditions related to update staging mechanisms. This logic error effectively bypasses authentication requirements because the vulnerable endpoint is accessible without prior credential validation, allowing any remote actor with network access to interact directly with the file system write operations associated with firmware and configuration management processes.
From a technical perspective, this flaw constitutes an unauthenticated arbitrary file write vulnerability. When an attacker sends a POST request to a fabricated CGI path, the server incorrectly interprets the payload as valid data intended for staging updates or parameter configurations. Consequently, the application writes the attacker-controlled content into temporary files located at /tmp/boa_temp.update and /tmp/boa_temp.para. These specific paths are critical because they serve as intermediate storage locations before firmware images are applied to the device's flash memory or when configuration parameters are being restored from backup archives. By controlling the contents of these files, an attacker can inject malicious scripts, corrupted binary data, or specially crafted XML structures that will be processed by subsequent system routines during the update or restore cycle. This mechanism bypasses standard integrity checks and authentication gates because the write operation occurs before any verification of the source or content validity takes place.
The operational impact of this vulnerability is severe and multifaceted, primarily centering on remote code execution potential and service disruption. If an attacker successfully overwrites /tmp/boa_temp.update with a malicious firmware image that includes backdoored binaries or modified system utilities, they can achieve persistent remote code execution upon the next scheduled update or manual trigger of the update process. This grants full administrative control over the device, enabling the compromise of the local network segment through which the router operates. Furthermore, tampering with /tmp/boa_temp.para allows for configuration manipulation that could redirect DNS queries to malicious servers, alter firewall rules to expose internal services, or inject persistent persistence mechanisms into startup scripts. In scenarios where integrity checks are less rigorous or if the attacker provides corrupted data intended to crash the update parser, the vulnerability can also be leveraged to cause a denial of service by rendering the device unable to boot correctly or function as a network gateway after an attempted restoration process fails due to invalid configuration files.
This flaw aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-434, which describes the unrestricted upload of file with dangerous type, and CWE-78, pertaining to improper neutralization of special elements used in an OS command if the injected content leads to execution. Additionally, from a threat modeling perspective consistent with the MITRE ATT&CK framework for IoT devices, this vulnerability facilitates initial access via unauthenticated endpoints and enables privilege escalation through manipulation of system update mechanisms. The attack vector is classified as remote across the network boundary, requiring no user interaction other than sending crafted HTTP packets to the target IP address on port 80 or 443 depending on configuration.
Mitigation strategies must prioritize immediate patching if a vendor-supplied firmware version addressing this logic error is available. Administrators should verify their device model and current software revision against Netcore’s official security advisories to determine eligibility for an update that restricts file write operations to authenticated sessions or validates the integrity of POST payloads before writing them to staging directories. In cases where patching is not immediately feasible, network-level controls such as firewall rules restricting access to the management interface should be implemented to limit exposure only to trusted IP addresses. Additionally, disabling remote administration features entirely when not required reduces the attack surface significantly. Regular monitoring for unusual outbound traffic or unexpected configuration changes can help detect exploitation attempts early, although prevention through strict input validation and authentication enforcement remains the most effective defense against this class of embedded system vulnerabilities.