External risk intelligence

Netis NC63 Stack Buffer Overflow via Login Password Parameter

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-76070

The vulnerability exists in the login handler of a consumer router's web interface. These device management interfaces are designed to be accessed via a web browser and are often exposed directly to the internet or are reachable by design as the primary gateway interface for the device.

Remote Code Execution

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Netis router firmware that could allow unauthenticated attackers to gain full control of affected devices. This flaw resides in how the system processes login credentials, potentially enabling attackers to execute arbitrary code with the highest level of privilege on the device.

Overly long passwords can grant full device control.
Unprotected network devices pose significant risk.
Confirm exposure; secure affected devices promptly.

Attack Path

How an attacker could exploit the issue

An attacker can remotely trigger this vulnerability by submitting a specially crafted, oversized Base64-encoded password to the device's login page. This crafted input exploits a weakness in how the system decodes Base64, leading to a buffer overflow that can overwrite critical program data on the stack. Successful exploitation allows an attacker to execute arbitrary code with the highest level of system privileges.

Unauthenticated remote access to the device.
Oversized Base64 password to login handler.
Remote code execution with root privileges.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated remote attackers to execute arbitrary code with root privileges on affected devices when they submit an oversized Base64-encoded password to the login handler. This could lead to a complete compromise of the device and any data it processes or stores.

Compromise of device and network control.
Submitted oversized Base64 password.
Complete device takeover possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Netis NC63 firmware's login handler is susceptible to remote code execution, posing a critical risk. Owners of Netis NC63 devices or the teams managing their network infrastructure should prioritize identifying all instances of this firmware. Confirming the device's business criticality and network exposure, especially if internet-facing, is essential to accurately assess risk and plan remediation.

Identify Netis NC63 device owners.
Verify device internet exposure and criticality.
Plan vendor-assisted remediation or replacement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Netis NC63 device?

The Netis NC63 is a consumer-grade wireless router. These devices serve as the central gateway for home or small office networks, managing internet connectivity and routing traffic between connected local devices and the wider internet.

What does CVE-2026-76070 mean by a stack-based buffer overflow?

This is a memory safety issue classified as CWE-121. In this case, the router's login software expects a password of a certain size but fails to check if the input is too long before processing it. By sending an oversized, Base64-encoded password, an attacker can overflow the fixed memory space allocated for login data, effectively overwriting critical system information to force the device to run unauthorized commands.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted, oversized Base64-encoded string as a password to the login handler located at /bin/netis.cgi. It is important to note that normal, valid password attempts or standard web traffic that does not involve this specific, overly large login payload do not cause this buffer overflow.

Why should I care about this vulnerability?

Halo Surface Signal indicates this is highly relevant because the vulnerability exists in a login handler designed for remote web management. If your device is configured to be reachable from the internet, it is at higher risk of being targeted by remote, unauthenticated attackers seeking full control over your gateway.

What should I do if I am running this technology?

Begin by identifying all Netis NC63 devices within your network environment. Evaluate whether these devices are exposed directly to the internet and assess their business or security importance. Once identified, monitor for official vendor firmware updates to remediate the vulnerability or consider replacing the hardware if a secure version is not available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.