CVE-2026-111711 Netcore CVE debrief

Who should care

Network administrators and security teams responsible for managing and securing Netcore NR256CN devices should be aware of this vulnerability and take necessary actions to mitigate it.

Why it matters

CVE-2026-111711 is a critical pre-authentication stack overflow vulnerability in Netcore NR256CN devices that requires immediate attention from network administrators and security teams to prevent potential exploitation and service disruption.

• Potential code execution on the affected device
• Crash of the main Boa process leading to service disruption
• Need for firmware updates or patches to address the vulnerability
• Potential for exploitation by unauthenticated attackers

Technical summary

The CVE-2026-111711 vulnerability is caused by a pre-authentication stack overflow in the Boa web server's user_ok() function of Netcore NR256CN through 1.5.140116. The vulnerability occurs when the function copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. An unauthenticated attacker can exploit this vulnerability by sending a username longer than 63 bytes to any protected /router/*.cgi route, which can cause the main Boa process to crash or potentially execute code.

Defensive priority

High

Recommended defensive actions

• Review and update the Netcore NR256CN firmware to a version that addresses this vulnerability
• Implement network access controls to restrict access to the /router/*.cgi routes
• Monitor network traffic for suspicious activity
• Consider replacing the affected device if it is no longer supported by the vendor
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but the vendor and affected versions are not clearly identified. The source references provide additional information about the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.