---
id: "CVE-2026-111710"
kind: "vulnerability"
aliases: ["CVE-2026-111710"]
title: "Netcore NR256CN router: malformed auth header crashes web management server"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NR256CN", "fixed": [], "affected": "<= 1.5.140116", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dos", "infrastructure", "netcore", "nr256cn", "router", "self-hosted"]
not_affected_if: ["lan-only-management", "management-interface-not-exposed", "other-firmware-versions", "remote-management-disabled"]
published_at: "2026-10-16T18:17:55+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-24T00:24:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111710", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:24:37+00:00"}]
---

# Netcore NR256CN router: malformed auth header crashes web management server

Netcore NR256CN firmware up to and including 1.5.140116: user_auth() in the Boa web server writes through the result of strchr(value, ':') without a NULL check. One unauthenticated request with a Basic Authorization value that decodes to no colon (for example to /router/get_user_type.cgi) kills the main Boa process and takes down the web management interface. Availability impact only (CVSS 3.1 7.5, 4.0 8.7). Found by Nebusec researchers. No public PoC, no known exploitation. No vendor fix was found. Sibling bugs in the same firmware (CVE-2026-111711 stack overflow, CVE-2026-111712 auth bypass) make this router risky to expose.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NR256CN affected <= 1.5.140116 fixed ?

## How to check

Check the firmware version in the router admin UI (System/Status page). 1.5.140116 or earlier is affected. Then test whether the management interface answers from WAN: from outside your network, try the router's public IP on its web admin port. If it responds, you are exposed.

## Fix

No fixed firmware version published as of 2026-10-24 (unknown; check Netcore's support site or ask the vendor). Mitigation: disable WAN/remote web management, restrict the admin interface to a trusted LAN or VPN, and put the device behind a firewall.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111710
- 2026-10-24T00:24:37+00:00 analyst — Read VulnCheck advisory and Nebusec reference (no vendor advisory found, no fixed firmware published; PoC withheld; not exploited, not in KEV). Sibling CVEs same product: 111711 (critical pre-auth stack overflow), 111712 (auth bypass), 112016.

## Documents

- [advisory] Nebusec reference: NR256CN Basic-auth NULL deref (PoC withheld) https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-basic-auth-null-deref.md
- [advisory] VulnCheck advisory CVE-2026-111710 https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-boa-web-server-null-pointer-dereference-dos

## From the sources

Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_