Live › vulnerability › CVE-2026-111710
Go to dashboardNetcore NR256CN firmware up to and including 1.5.140116: user_auth() in the Boa web server writes through the result of strchr(value, ':') without a NULL check. One unauthenticated request with a Basic Authorization value that decodes to no colon (for example to /router/get_user_type.cgi) kills the main Boa process and takes down the web management interface. Availability impact only (CVSS 3.1 7.5, 4.0 8.7). Found by Nebusec researchers. No public PoC, no known exploitation. No vendor fix was found. Sibling bugs in the same firmware (CVE-2026-111711 stack overflow, CVE-2026-111712 auth bypass) make this router risky to expose.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| NR256CN | vendor | <= 1.5.140116 | – |
1.5.140116 or earlier is affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.
This page as .md · .json · in your agent: get_signal("CVE-2026-111710")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.