An unauthenticated attacker can exploit this by submitting an HTTP request to any protected /router/*.cgi endpoint with a crafted Authorization header containing a username longer than 63 bytes. Depending on the memory layout and overwrite, this can lead to an immediate crash of the Boa process, resulting in a denial-of-service, or allow for the redirection of execution flow to attacker-controlled payloads. This vulnerability is highly dangerous as it requires no prior authentication and targets core routing infrastructure.

Impact

Successful exploitation of CVE-2026-111711 allows unauthenticated remote attackers to cause a complete denial-of-service of the router's management interface or achieve remote code execution. This poses a significant threat to internal network security, as attackers could potentially gain full control of the network gateway, intercept traffic, or pivot into local segments. The scope includes all Netcore NR256CN devices running firmware 1.5.140116 or earlier.

Recommendation

• Restrict access to the router management interface to trusted internal IP ranges only.
• Monitor network traffic for HTTP requests to /router/*.cgi endpoints that feature abnormally long Basic authentication headers.
• Implement an WAF rule or perimeter filter to drop any incoming HTTP Authorization header where the username string exceeds 63 characters.
• Contact the vendor to obtain firmware patches or security updates for the NR256CN product line that address this buffer overflow.