{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nc63-ac1200-wireless-dual-band-gigabit-mu-mimo-router/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NC63 AC1200 Wireless Dual Band Gigabit MU-MIMO Router"],"_cs_severities":["high"],"_cs_tags":["cve-2026-76071","rce","network-security","buffer-overflow"],"_cs_type":"advisory","_cs_vendors":["Netis"],"content_html":"\u003cp\u003eResearchers identified a critical vulnerability, tracked as CVE-2026-76071, affecting the Netis NC63 AC1200 Wireless Dual Band Gigabit MU-MIMO Router running firmware version NC63_V3.0.0.3327. The vulnerability exists within the \u003ccode\u003eskk_set.cgi\u003c/code\u003e handler, which processes the \u003ccode\u003eipFilterList\u003c/code\u003e parameter using the \u003ccode\u003esscanf\u003c/code\u003e function with an unbounded \u003ccode\u003e%[^,]\u003c/code\u003e format specifier.\u003c/p\u003e\n\u003cp\u003eBecause the underlying code copies user-supplied input into a 16-byte local stack buffer without bounds checking, an unauthenticated attacker can supply an overly long string in the \u003ccode\u003edestHost\u003c/code\u003e field to overwrite the function's saved return address. The vulnerability is highly impactful as the router's CGI interface runs with root privileges and lacks modern exploit mitigations like stack canaries, NX, or RELRO. Proof-of-concept code is publicly available, enabling attackers to gain full device control, redirect traffic, or extract configuration secrets from vulnerable routers exposed to the network.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker reconnaissance identifies an internet-facing Netis NC63 router with the management CGI interface exposed.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request targeting \u003ccode\u003e/cgi-bin/skk_set.cgi\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe request body includes the \u003ccode\u003eipFilterList=mod\u003c/code\u003e trigger to invoke the vulnerable parser.\u003c/li\u003e\n\u003cli\u003eThe attacker provides a specially crafted, long string in the \u003ccode\u003edestHost\u003c/code\u003e parameter to exceed the 16-byte destination buffer.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esscanf\u003c/code\u003e function writes the payload into the stack frame, overflowing the buffer and overwriting the saved frame pointer and return address (ra).\u003c/li\u003e\n\u003cli\u003eThe parser epilogue executes, causing the CPU to jump to an attacker-controlled address (e.g., the system() PLT path).\u003c/li\u003e\n\u003cli\u003eThe attacker provides a command-string suffix in the original request to execute arbitrary system commands as root.\u003c/li\u003e\n\u003cli\u003eSuccessful execution leads to full device compromise and potential persistence or traffic manipulation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary command execution with root privileges on the affected Netis NC63 routers. This allows attackers to extract sensitive configurations, manipulate DNS and firewall settings to intercept traffic, brick the device, or incorporate it into a botnet. While the PoC is a crash/PC-control demonstration, the primitive allows full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate isolation of management interfaces from the public internet to prevent exploitation of CVE-2026-76071.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAudit webserver logs for large or abnormally long strings in the \u003ccode\u003edestHost\u003c/code\u003e parameter of POST requests to \u003ccode\u003e/cgi-bin/skk_set.cgi\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eBlock inbound traffic to \u003ccode\u003e/cgi-bin/skk_set.cgi\u003c/code\u003e from untrusted networks at the network perimeter.\u003c/li\u003e\n\u003cli\u003eApply firmware updates provided by Netis if a patch for CVE-2026-76071 is released.\u003c/li\u003e\n\u003cli\u003eDeploy detection rules targeting unauthenticated access attempts to the management CGI interface if possible in your network segment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-20T00:48:28Z","date_published":"2026-08-20T00:48:28Z","id":"https://feed.craftedsignal.io/briefs/2026-08-netis-nc63-rce/","summary":"An unauthenticated stack-based buffer overflow in the Netis NC63 router management interface allows remote code execution via a crafted HTTP request to skk_set.cgi.","title":"Unauthenticated RCE in Netis NC63 via Stack Buffer Overflow","url":"https://feed.craftedsignal.io/briefs/2026-08-netis-nc63-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - NC63 AC1200 Wireless Dual Band Gigabit MU-MIMO Router","version":"https://jsonfeed.org/version/1.1"}