Unauthenticated RCE in Netis NC63 via Stack Buffer Overflow

Researchers identified a critical vulnerability, tracked as CVE-2026-76071, affecting the Netis NC63 AC1200 Wireless Dual Band Gigabit MU-MIMO Router running firmware version NC63_V3.0.0.3327. The vulnerability exists within the skk_set.cgi handler, which processes the ipFilterList parameter using the sscanf function with an unbounded %[^,] format specifier.

Because the underlying code copies user-supplied input into a 16-byte local stack buffer without bounds checking, an unauthenticated attacker can supply an overly long string in the destHost field to overwrite the function's saved return address. The vulnerability is highly impactful as the router's CGI interface runs with root privileges and lacks modern exploit mitigations like stack canaries, NX, or RELRO. Proof-of-concept code is publicly available, enabling attackers to gain full device control, redirect traffic, or extract configuration secrets from vulnerable routers exposed to the network.

Attack Chain

1. Attacker reconnaissance identifies an internet-facing Netis NC63 router with the management CGI interface exposed.
2. The attacker crafts a malicious HTTP POST request targeting /cgi-bin/skk_set.cgi.
3. The request body includes the ipFilterList=mod trigger to invoke the vulnerable parser.
4. The attacker provides a specially crafted, long string in the destHost parameter to exceed the 16-byte destination buffer.
5. The sscanf function writes the payload into the stack frame, overflowing the buffer and overwriting the saved frame pointer and return address (ra).
6. The parser epilogue executes, causing the CPU to jump to an attacker-controlled address (e.g., the system() PLT path).
7. The attacker provides a command-string suffix in the original request to execute arbitrary system commands as root.
8. Successful execution leads to full device compromise and potential persistence or traffic manipulation.

Impact

Successful exploitation results in arbitrary command execution with root privileges on the affected Netis NC63 routers. This allows attackers to extract sensitive configurations, manipulate DNS and firewall settings to intercept traffic, brick the device, or incorporate it into a botnet. While the PoC is a crash/PC-control demonstration, the primitive allows full system compromise.

Recommendation

Prioritize the immediate isolation of management interfaces from the public internet to prevent exploitation of CVE-2026-76071.

• Audit webserver logs for large or abnormally long strings in the destHost parameter of POST requests to /cgi-bin/skk_set.cgi.
• Block inbound traffic to /cgi-bin/skk_set.cgi from untrusted networks at the network perimeter.
• Apply firmware updates provided by Netis if a patch for CVE-2026-76071 is released.
• Deploy detection rules targeting unauthenticated access attempts to the management CGI interface if possible in your network segment.