{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-111711/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:netcore:nr256cn:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111711"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NR256CN (\u003c= 1.5.140116)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-111711","vulnerability","network-device","remote-code-execution","denial-of-service","network-infrastructure"],"_cs_type":"advisory","_cs_vendors":["Netcore"],"content_html":"\u003cp\u003eNetcore NR256CN routers running firmware versions up to 1.5.140116 contain a critical stack-based buffer overflow vulnerability identified as CVE-2026-111711. The flaw exists within the user_ok() function of the embedded Boa web server, which handles Basic authentication. Specifically, the function utilizes an unbounded strcpy() call to copy the username field into a fixed 64-byte stack buffer without performing length validation.\u003c/p\u003e\n\u003cp\u003eAn unauthenticated attacker can exploit this by submitting an HTTP request to any protected /router/*.cgi endpoint with a crafted Authorization header containing a username longer than 63 bytes. Depending on the memory layout and overwrite, this can lead to an immediate crash of the Boa process, resulting in a denial-of-service, or allow for the redirection of execution flow to attacker-controlled payloads. This vulnerability is highly dangerous as it requires no prior authentication and targets core routing infrastructure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-111711 allows unauthenticated remote attackers to cause a complete denial-of-service of the router's management interface or achieve remote code execution. This poses a significant threat to internal network security, as attackers could potentially gain full control of the network gateway, intercept traffic, or pivot into local segments. The scope includes all Netcore NR256CN devices running firmware 1.5.140116 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict access to the router management interface to trusted internal IP ranges only.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for HTTP requests to /router/*.cgi endpoints that feature abnormally long Basic authentication headers.\u003c/li\u003e\n\u003cli\u003eImplement an WAF rule or perimeter filter to drop any incoming HTTP Authorization header where the username string exceeds 63 characters.\u003c/li\u003e\n\u003cli\u003eContact the vendor to obtain firmware patches or security updates for the NR256CN product line that address this buffer overflow.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:51:11Z","date_published":"2026-10-16T18:46:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-netcore-cve-2026-111711/","summary":"Netcore NR256CN routers up to version 1.5.140116 are vulnerable to a pre-authentication stack buffer overflow in the Boa web server's user_ok() function, allowing remote code execution or denial-of-service.","title":"Pre-Authentication Stack Overflow in Netcore NR256CN Routers","url":"https://feed.craftedsignal.io/briefs/2026-10-netcore-cve-2026-111711/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-111711","version":"https://jsonfeed.org/version/1.1"}