CVE-2026-111712: Authentication Bypass Using an Alternate Path or Channel in Netcore NR256CN

CVE-2026-111712 describes an authentication bypass vulnerability in Netcore NR256CN firmware versions up to 1.5.140116. The issue arises because the device improperly handles URI prefixes, allowing unauthenticated requests to reach protected management CGI handlers. Specifically, attackers can prefix URIs with l7_web_auth.cgi or .ico routes to bypass authentication controls and invoke management functions without credentials. This vulnerability is network exploitable without user interaction and has low vector and impact complexity, with limited confidentiality and integrity impacts.

An unauthenticated attacker can bypass authentication mechanisms to access protected management interfaces on affected Netcore NR256CN devices. This could allow unauthorized management actions, potentially compromising device configuration or operation. The impact is rated medium severity with limited confidentiality and integrity impact as per the CVSS 4.0 vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to management interfaces and monitor for suspicious access attempts involving the specified URI prefixes.