Live › vulnerability › CVE-2026-111712
Go to dashboardNetcore NR256CN routers through firmware 1.5.140116 let unauthenticated attackers reach protected management CGI handlers by prefixing the request path with a public route such as l7_web_auth.cgi or an .ico path. An attacker can invoke administrative functions on the device without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Owners of Netcore NR256CN routers running firmware through 1.5.140116 are exposed, and the flaw is reachable by anyone who can send HTTP requests to the web management interface. Devices where the management interface is not reachable from untrusted networks are less exposed, but the sources do not say how far the exposure extends. Teams that do not run this hardware can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-111712")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.