{"id":"CVE-2026-111712","kind":"vulnerability","aliases":["CVE-2026-111712"],"related":[],"title":"Netcore NR256CN router: authentication bypass exposes management handlers without credentials","description":"Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.","summary":"Netcore NR256CN routers through firmware 1.5.140116 let unauthenticated attackers reach protected management CGI handlers by prefixing the request path with a public route such as l7_web_auth.cgi or an .ico path. An attacker can invoke administrative functions on the device without logging in.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","netcore","nr256cn","router","web-management"],"not_affected_if":["management-interface-not-reachable","not-nr256cn-hardware"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T18:17:55+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:42:17+00:00","updated_at":"2026-10-25T03:42:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:42:17Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Netcore NR256CN router: authentication bypass exposes management handlers without credentials","impact":"high","summary":"Netcore NR256CN routers through firmware 1.5.140116 let unauthenticated attackers reach protected management CGI handlers by prefixing the request path with a public route such as l7_web_auth.cgi or an .ico path. An attacker can invoke administrative functions on the device without logging in.","category":"infrastructure","nicknames":[],"who_cares":["netcore","nr256cn","router","embedded","web-management"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated attacker invokes administrative functions on the router","analyst_note":"Check the NVD entry and vendor advisories for a fixed firmware version and whether the web management interface is exposed by default on WAN.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["not-nr256cn-hardware","management-interface-not-reachable"],"who_is_affected":"Owners of Netcore NR256CN routers running firmware through 1.5.140116 are exposed, and the flaw is reachable by anyone who can send HTTP requests to the web management interface. Devices where the management interface is not reachable from untrusted networks are less exposed, but the sources do not say how far the exposure extends. Teams that do not run this hardware can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000595,"input_tokens":3336,"output_tokens":522,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111712':13A,16A '-2026':12A,15A '1.5.140116':30B,69C 'administr':59B 'allow':76C 'attack':33B,56B,78C,93C 'authent':4A,72C 'bypass':5A,73C 'cgi':37B,83C 'contain':70C 'credenti':10A,110C 'cve':11A,14A 'devic':63B 'embed':17B 'expos':6A 'firmwar':29B 'function':60B 'handler':8A,38B,84C,108C 'ico':53B,102C 'infrastructur':18B 'invok':58B,105C 'l7_web_auth.cgi':50B,99C 'let':31B 'log':65B 'manag':7A,24B,36B,82C,107C 'netcor':1A,19B,25B,66C 'nr256cn':2A,20B,26B,67C 'path':43B,54B,96C 'prefix':40B,86C,97C 'protect':35B,81C,106C 'public':46B,91C 'reach':34B,80C 'request':42B,95C 'rout':47B,92C,103C 'router':3A,21B,27B 'unauthent':32B,77C 'uri':88C 'vulner':74C 'web':23B 'web-manag':22B 'without':9A,64B,109C","nicknames":[],"mitigations":[],"who_affected":"Owners of Netcore NR256CN routers running firmware through 1.5.140116 are exposed, and the flaw is reachable by anyone who can send HTTP requests to the web management interface. Devices where the management interface is not reachable from untrusted networks are less exposed, but the sources do not say how far the exposure extends. Teams that do not run this hardware can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111712","severity":null,"published_at":"2026-10-16T18:17:55+00:00","modified_at":"2026-10-16T19:17:05+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}