{"id":"CVE-2026-111710","kind":"vulnerability","aliases":["CVE-2026-111710"],"related":[],"title":"Netcore NR256CN router: malformed auth header crashes web management server","description":"Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.","summary":"Netcore NR256CN firmware up to and including 1.5.140116: user_auth() in the Boa web server writes through the result of strchr(value, ':') without a NULL check. One unauthenticated request with a Basic Authorization value that decodes to no colon (for example to /router/get_user_type.cgi) kills the main Boa process and takes down the web management interface. Availability impact only (CVSS 3.1 7.5, 4.0 8.7). Found by Nebusec researchers. No public PoC, no known exploitation. No vendor fix was found. Sibling bugs in the same firmware (CVE-2026-111711 stack overflow, CVE-2026-111712 auth bypass) make this router risky to expose.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NR256CN","fixed":[],"affected":"<= 1.5.140116","ecosystem":"vendor"}],"ecosystems":[],"tags":["dos","infrastructure","netcore","nr256cn","router","self-hosted"],"not_affected_if":["lan-only-management","management-interface-not-exposed","other-firmware-versions","remote-management-disabled"],"how_to_check":"Check the firmware version in the router admin UI (System/Status page). 1.5.140116 or earlier is affected. Then test whether the management interface answers from WAN: from outside your network, try the router's public IP on its web admin port. If it responds, you are exposed.","fix":"No fixed firmware version published as of 2026-10-24 (unknown; check Netcore's support site or ask the vendor). Mitigation: disable WAN/remote web management, restrict the admin interface to a trusted LAN or VPN, and put the device behind a firewall.","status":"open","published_at":"2026-10-16T18:17:55+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:37:40+00:00","updated_at":"2026-10-24T00:24:37+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:37:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Netcore NR256CN router: malformed auth header crashes web management server","impact":"low","summary":"Netcore NR256CN routers through firmware 1.5.140116 have a NULL pointer dereference in the Boa web server's login check. An unauthenticated attacker sends a Basic Authorization header without a colon and kills the main Boa process, denying access to the management interface.","category":"infrastructure","who_cares":["netcore","nr256cn","router","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Management web interface crashes and stays down; denial of service only.","analyst_note":"Confirm the fixed firmware version and whether the web management interface is reachable from WAN; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111710 and vendor advisories.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["management-interface-not-exposed","other-firmware-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000493,"input_tokens":2962,"output_tokens":393,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed firmware version and whether the web management interface is reachable from WAN; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111710 and vendor advisories.","search":"'-111710':13A,16A '-111711':112B '-111712':117B '-2026':12A,15A,111B,116B '/router/get_user_type.cgi':68B,180C '1.5.140116':33B,129C '3.1':85B '4.0':87B '7.5':86B '8.7':88B 'access':191C 'allow':146C 'attack':148C,158C 'auth':5A,35B,118B,143C 'author':58B,156C,163C 'avail':81B 'basic':57B,162C 'boa':38B,72B,138C,185C 'bug':105B 'bypass':119B 'charact':175C 'check':51B 'colon':64B,167C 'contain':130C 'crash':7A,150C 'cve':11A,14A,110B,115B 'cvss':84B 'decod':61B,171C 'deni':188C 'derefer':134C 'dos':18B 'exampl':66B 'exploit':98B 'expos':125B 'firmwar':28B,109B 'fix':101B 'found':89B,103B 'function':144C 'header':6A,157C 'host':25B 'impact':82B 'includ':32B 'infrastructur':19B 'interfac':80B,190C 'kill':69B,182C 'known':97B 'lack':165C 'like':179C 'main':71B,184C 'make':120B 'malform':4A,155C 'manag':9A,79B,189C 'nebusec':91B 'netcor':1A,20B,26B,126C 'nr256cn':2A,17A,21B,27B,127C 'null':50B,132C 'one':52B,170C 'overflow':114B 'poc':95B 'pointer':133C 'process':73B,186C 'protect':177C 'public':94B 'request':54B 'research':92B 'result':44B 'riski':123B 'rout':178C 'router':3A,22B,122B 'self':24B 'self-host':23B 'send':160C 'server':10A,40B,140C,152C 'sibl':104B 'singl':174C 'stack':113B 'strchr':46B 'take':75B 'unauthent':53B,147C 'user':34B,142C 'valu':47B,59B,164C 'vendor':100B 'via':153C 'vulner':135C 'web':8A,39B,78B,139C 'without':48B 'write':41B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111710","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111710","severity":null,"published_at":"2026-10-16T18:17:55+00:00","modified_at":"2026-10-19T15:16:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111710:654","url":null,"severity":null,"published_at":"2026-10-24T00:24:37+00:00","modified_at":"2026-10-24T00:24:37+00:00","first_seen_at":"2026-10-24T00:24:37+00:00","fetched_at":"2026-10-24T00:24:37+00:00","note":"Read VulnCheck advisory and Nebusec reference (no vendor advisory found, no fixed firmware published; PoC withheld; not exploited, not in KEV). Sibling CVEs same product: 111711 (critical pre-auth stack overflow), 111712 (auth bypass), 112016."}],"documents":[{"id":2593,"url":"https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-basic-auth-null-deref.md","title":"Nebusec reference: NR256CN Basic-auth NULL deref (PoC withheld)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2594,"url":"https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-boa-web-server-null-pointer-dereference-dos","title":"VulnCheck advisory CVE-2026-111710","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}