CVE-2026-111711: Stack-based Buffer Overflow in Netcore NR256CN

CVE-2026-111711 is a stack-based buffer overflow vulnerability in the Boa web server component of Netcore NR256CN devices through version 1.5.140116. The vulnerability exists in the user_ok() function, which uses unsafe strcpy() calls to copy Basic-auth usernames into 64-byte stack buffers without length checks. This allows unauthenticated attackers to send overly long usernames to protected /router/*.cgi routes, leading to a crash of the Boa process or possibly arbitrary code execution. The CVSS 4.0 score is 9.3 (critical), reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can cause denial of service by crashing the Boa web server process or potentially allow remote code execution with no authentication required. This compromises device availability and may allow attackers to gain control over affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable /router/*.cgi endpoints and monitor for attempts to send overly long Basic-auth usernames. Avoid exposing the management interface to untrusted networks.