CVE-2026-111710: NULL Pointer Dereference in Netcore NR256CN

CVE-2026-111710 is a NULL pointer dereference vulnerability in the Boa web server component of Netcore NR256CN devices through version 1.5.140116. The vulnerability occurs in the user_auth() function when processing Basic Authorization headers that lack a colon character. An attacker can exploit this by sending a malformed Authorization header to protected routes such as /router/get_user_type.cgi, which crashes the main Boa process and results in denial of service to the device's management interface. The vulnerability requires no authentication and has a CVSS 4.0 base score of 8.7, indicating high severity.

Successful exploitation causes the Boa web server process to crash, resulting in denial of service to the management interface of affected Netcore NR256CN devices. This prevents legitimate administrators from accessing the device's management functions until the server is restarted or the device is rebooted.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restricting access to the management interface from untrusted networks may reduce exposure.