External risk intelligence

Netcore NR256CN Pre-Authentication Stack Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-111711

The vulnerability affects a router web interface, which is designed to be accessible via network requests. As a home or small office networking device, the administrative web interface is frequently exposed to the public internet or is at least intended to be reachable via common network configurations, making it a high-probability target for public-facing exploitation.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a widely used networking device allows unauthenticated attackers to crash the system or potentially execute code by sending overly long usernames. This flaw is located in the web server's handling of authentication credentials.

Issue: Unauthenticated attackers can crash or exploit network devices.
Why remember: Affects network devices, a common business asset.
Executive takeaway: Confirm relevance and exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can target a router's web interface, which is often exposed to the internet, by sending a specially crafted username. This username, exceeding 63 bytes, targets a function within the Boa web server that copies the username to a small buffer without checking its length. This causes the web server process to crash, and potentially allows for arbitrary code execution.

No authentication required.
Triggered by long username in HTTP request.
Potential for denial-of-service or code execution.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could impact devices with Netcore NR256CN firmware by sending specially crafted network requests. This could lead to the main web server process crashing or potentially allow for code execution.

Router process and availability.
Unbounded username copies can overflow buffers.
Denial of service or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Netcore routers, suggesting that infrastructure, network, and possibly vendor-management teams are likely responsible for remediation. The immediate first step is to identify all instances of the affected router model, determine their network exposure and criticality, and locate the designated owner for each device before planning mitigation or a firmware update.

Infrastructure and network teams own remediation.
Verify router exposure and critical assets first.
Plan vendor coordination and controlled updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Netcore NR256CN router?

The Netcore NR256CN is a networking device typically used in homes or small offices to manage internet connectivity. It relies on the Boa web server to provide an administrative interface, allowing users to configure network settings, security, and device performance through a browser.

What does CVE-2026-111711 mean technically?

This vulnerability is a stack-based buffer overflow (CWE-121). It occurs because the Boa web server uses an unsafe function to copy usernames during login. When a username exceeds the 64-byte limit of the assigned memory space, it overwrites adjacent data, which can crash the web server or permit unauthorized code execution.

How is this vulnerability triggered?

An attacker triggers this by sending an HTTP request containing a username longer than 63 bytes to a protected route under /router/. Because the check happens before authentication, no valid credentials are required to initiate the overflow. Requests with usernames shorter than 64 bytes do not trigger this memory error.

Why is this router vulnerability a concern?

Halo Surface Signal indicates this issue is critical because the affected web interface is designed to be reachable over the network. If your device is accessible from the internet, it is at higher risk of being targeted by unauthenticated actors looking to crash the router or manipulate its processes.

What should I do if I use this router?

First, audit your network to identify all instances of this specific model and confirm their connectivity status. Check if these devices are exposed to the internet. Once identified, coordinate with your network or infrastructure team to track official firmware updates from the manufacturer or restrict administrative access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.