CVE-2026-111711

Summary

A stack overflow vulnerability exists in Netcore NR256CN routers' Boa web server that allows unauthenticated attackers to crash the system or potentially execute code by sending overly long usernames during Basic authentication. This affects all protected CGI routes and can lead to complete system compromise.

Exploitability

Exploitation is relatively straightforward requiring only a single HTTP request with a username longer than 63 bytes to any protected /router/*.cgi endpoint, with no authentication required.

Blast radius

The vulnerability affects all Netcore NR256CN routers running firmware versions through 1.5.140116, potentially impacting thousands of devices in enterprise and residential networks that rely on these routers for connectivity.

Detection

Monitor for HTTP requests containing Basic-auth headers with usernames exceeding 63 bytes to /router/*.cgi endpoints in web server logs, particularly looking for repeated connection resets or process crashes in the Boa web server process.

Prioritized remediation

Upgrade to firmware version 1.5.140117 or later immediately, as this is the first fixed version specifically mentioned in the CVE description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.