Netis Systems NC63 up to 3.0.0.3327 Base64 decoder /bin/netis.cgi buffer overflow

Summaryinfo

A vulnerability classified as very critical has been found in Netis Systems NC63 up to 3.0.0.3327. This affects an unknown part of the file /bin/netis.cgi of the component Base64 decoder. The manipulation leads to buffer overflow. This vulnerability is referenced as CVE-2026-76070. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Netis Systems NC63 up to 3.0.0.3327. This issue affects some unknown processing of the file /bin/netis.cgi of the component Base64 decoder. The manipulation with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi. Attackers can exploit the custom Base64 decoder's lack of output length validation against the fixed-size stack buffer to achieve remote code execution with root privileges, as the Boa web server executes the CGI environment as root.

It is possible to read the advisory at ozcanpng.dev. The identification of this vulnerability is CVE-2026-76070 since 08/18/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/24/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Netis Systems

Name

• NC63

Version

• 3.0.0.3327

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion