{"id":"CVE-2026-112016","kind":"vulnerability","aliases":["CVE-2026-112016"],"related":[],"title":"Netcore NR256CN router: unauthenticated remote file write via web server","description":"Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into /tmp/boa_temp.update or /tmp/boa_temp.para, tampering with pending firmware updates or configuration restores or causing denial of service.","summary":"The Netcore NR256CN router's Boa-derived web server lets any remote user POST to a non-existent .cgi path and write attacker-controlled content into staging files used for firmware updates and configuration restores. An attacker can tamper with pending firmware or config restores, or cause a denial of service.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["boa","infrastructure","netcore","nr256cn","router","self-hosted"],"not_affected_if":["management-interface-not-exposed","other-firmware"],"how_to_check":"- Check the router's firmware version against the affected range (through 1.5.140116), where the version is shown in the admin interface or on the device label\n- unknown for a network-side test command; the sources do not say","fix":"- unknown: the sources do not name a fixed firmware version\n- Restrict access to the router's web management interface to trusted networks until a vendor patch is confirmed","status":"open","published_at":"2026-10-18T12:17:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:41:02+00:00","updated_at":"2026-10-25T03:41:02+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:41:02Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed firmware version\n- Restrict access to the router's web management interface to trusted networks until a vendor patch is confirmed","reach":"network","title":"Netcore NR256CN router: unauthenticated remote file write via web server","impact":"medium","summary":"The Netcore NR256CN router's Boa-derived web server lets any remote user POST to a non-existent .cgi path and write attacker-controlled content into staging files used for firmware updates and configuration restores. An attacker can tamper with pending firmware or config restores, or cause a denial of service.","category":"infrastructure","nicknames":[],"who_cares":["netcore","nr256cn","router","boa","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker tampers with firmware updates or config restores, or crashes the device","analyst_note":"Find the vendor advisory or a fixed firmware version for NR256CN, and confirm whether the management interface is exposed on WAN by default (see https://nvd.nist.gov/vuln/detail/CVE-2026-112016).","how_to_check":"- Check the router's firmware version against the affected range (through 1.5.140116), where the version is shown in the admin interface or on the device label\n- unknown for a network-side test command; the sources do not say","needs_analyst":true,"not_affected_if":["other-firmware","management-interface-not-exposed"],"who_is_affected":"Teams that run Netcore NR256CN routers with firmware through 1.5.140116 and expose the web management interface to untrusted networks. The sources do not say whether the flaw is reachable from the WAN by default, so assume the management port is reachable where it is not explicitly firewalled.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000651,"input_tokens":3382,"output_tokens":626,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112016':13A,16A '-2026':12A,15A '/bin/boa':94C '/tmp/boa_temp.para':127C '/tmp/boa_temp.update':125C '1.5.140116':82C 'allow':98C 'attack':50B,64B,100C,108C,121C 'attacker-control':49B,120C 'boa':17B,31B,92C 'boa-deriv':30B,91C 'caus':74B,137C 'cgi':45B,116C 'config':71B 'configur':61B,134C 'contain':83C 'content':52B,123C 'control':51B,122C 'cve':11A,14A 'denial':76B,138C 'deriv':32B,93C 'exist':44B,115C 'file':6A,55B,86C,107C 'firmwar':58B,69B,131C 'host':24B 'infrastructur':18B 'let':35B 'netcor':1A,19B,26B,79C 'non':43B,114C 'non-exist':42B,113C 'nr256cn':2A,20B,27B,80C 'overwrit':102C 'path':46B 'pathnam':117C 'pend':68B,130C 'post':39B,110C 'remot':5A,37B,99C 'restor':62B,72B,105C,135C 'router':3A,21B,28B 'self':23B 'self-host':22B 'server':10A,34B,96C 'servic':78B,140C 'stage':54B,106C 'tamper':66B,128C 'unauthent':4A,85C 'updat':59B,103C,132C 'use':56B 'user':38B 'via':8A 'vulner':88C 'web':9A,33B,95C 'write':7A,48B,87C,119C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Netcore NR256CN routers with firmware through 1.5.140116 and expose the web management interface to untrusted networks. The sources do not say whether the flaw is reachable from the WAN by default, so assume the management port is reachable where it is not explicitly firewalled.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112016","severity":null,"published_at":"2026-10-18T12:17:14+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}