CVE-2026-76070 is a stack-based buffer overflow vulnerability in Netis NC63 firmware through version 3.0.0.3327. The issue occurs because the custom Base64 decoder in the login handler does not validate output length against a fixed-size stack buffer. An attacker can submit an oversized Base64-encoded password to /bin/netis.cgi, causing a buffer overflow that overwrites saved stack state. Since the Boa web server executes CGI scripts with root privileges, successful exploitation can lead to remote code execution as root without authentication.

This vulnerability allows unauthenticated remote attackers to execute arbitrary code with root privileges on affected Netis NC63 devices. The critical severity and high CVSS score (9.3) reflect the potential for complete device compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the device's management interface from untrusted networks to reduce exposure.