CVE-2026-112016 Netcore CVE debrief

Who should care

Defenders responsible for Netcore NR256CN devices, particularly those in network infrastructure or IoT deployments, should assess exposure and verify patching to prevent potential unauthenticated file writes.

Why it matters

CVE-2026-112016 is a medium-severity vulnerability in Netcore NR256CN devices that allows unauthenticated file writes, potentially leading to denial of service or tampering with firmware updates and configuration restores. Defenders should assess exposure, verify patching, and monitor for suspicious activity.

• Potential for tampering with pending firmware updates or configuration restores
• Possible denial of service due to overwritten staging files
• Need for verification of patching and updates for Netcore NR256CN devices
• Potential for attackers to write arbitrary content to staging files

Technical summary

The Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server. This allows remote attackers to overwrite update and restore staging files by POSTing to a non-existent .cgi pathname, writing attacker-controlled content into /tmp/boa_temp.update or /tmp/boa_temp.para. This can be used to tamper with pending firmware updates or configuration restores, or cause denial of service.

Defensive priority

Medium priority for defenders to assess exposure and verify patching due to potential for unauthenticated file writes.

Recommended defensive actions

• Assess exposure of Netcore NR256CN devices to unauthenticated file write attacks
• Verify patching and updates for Netcore NR256CN devices
• Monitor for suspicious activity related to firmware updates or configuration restores
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the unauthenticated file write vulnerability in Netcore NR256CN through 1.5.140116. Limited information is available on affected or fixed versions, exploitation, or specific impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.