Threats tagged 'ghsa-5769-g37j-m8jq'

Netcore NR256CN devices up to version 1.5.140116 have a critical pre-authentication stack-based buffer overflow vulnerability in the Boa web server's user_ok() function. This flaw arises from unbounded strcpy() calls copying Basic-auth usernames into fixed 64-byte stack buffers. An unauthenticated attacker can exploit this by sending a username longer than 63 bytes to any protected /router/*.cgi route, potentially crashing the Boa process or executing arbitrary code.