Remote Code Execution in Netis NC63 Firmware via Buffer Overflow

Netis NC63 firmware versions through V3.0.0.3327 contain a high-severity stack-based buffer overflow vulnerability, identified as CVE-2026-76070. The flaw resides within the login handler of the /bin/netis.cgi binary, which utilizes a custom Base64 decoding implementation. Due to the absence of proper length validation during the decoding process, an attacker can supply an oversized Base64-encoded password string to trigger a memory corruption event.

The overflow occurs on a fixed-size stack buffer, enabling the attacker to overwrite the saved stack state and control the program execution flow. Because the underlying Boa web server operates with root privileges, this exploit results in full system compromise. This vulnerability is significant due to the lack of authentication required to reach the vulnerable code path and the resulting elevated execution context, posing a critical risk to affected network devices.

Impact

Successful exploitation allows unauthenticated remote attackers to gain root-level access to the affected Netis NC63 routers. This enables full device control, potential persistent access, lateral movement within the local network, and interception of sensitive traffic traversing the gateway.

Recommendation

• Immediately upgrade Netis NC63 firmware to a version beyond V3.0.0.3327 if a patch is provided by the vendor.
• If patching is not immediately feasible, restrict access to the web management interface of the Netis NC63 to trusted IP addresses only, using firewall rules.
• Monitor network traffic directed toward the web management port (typically 80 or 443) for unusually large or malformed strings sent to netis.cgi.