Live › vulnerability › CVE-2026-112016
Go to dashboardThe Netcore NR256CN router's Boa-derived web server lets any remote user POST to a non-existent .cgi path and write attacker-controlled content into staging files used for firmware updates and configuration restores. An attacker can tamper with pending firmware or config restores, or cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Netcore NR256CN routers with firmware through 1.5.140116 and expose the web management interface to untrusted networks. The sources do not say whether the flaw is reachable from the WAN by default, so assume the management port is reachable where it is not explicitly firewalled.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into /tmp/boa_temp.update or /tmp/boa_temp.para, tampering with pending firmware updates or configuration restores or causing denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-112016")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.