External risk intelligence

Netis NC63 Stack Buffer Overflow Leads to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-76071

The vulnerability affects consumer router firmware and is reachable via the device's web management interface. These devices are designed to be internet-connected edge gateways, and the vulnerable CGI endpoint is accessible without authentication, making the attack surface directly exposed to the public internet.

Remote Code Execution

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Netis NC63 router firmware, allowing unauthenticated remote attackers to execute code with root privileges by exploiting a stack-based buffer overflow. This occurs when an attacker sends a specially crafted request to the device's web management interface, potentially leading to a complete compromise of the affected devices.

Unauthenticated remote code execution is possible.
Affects internet-facing network edge devices.
Confirm relevance and exposure of affected devices.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit a stack-based buffer overflow vulnerability in the router's web interface. By sending specially crafted input as the `destHost` parameter in a specific CGI request, an attacker can overwrite critical data on the stack. This overflow occurs before any authentication checks, allowing for the execution of arbitrary code with root privileges due to how the web server runs CGI scripts.

No authentication required.
Oversized `destHost` parameter in `netis.cgi`.
Remote code execution as root.

Live Threat

Current exploitation, exposure, and threat context

The Netis NC63 firmware contains a stack-based buffer overflow vulnerability that could allow unauthenticated remote attackers to execute arbitrary code as root. This is possible when an oversized `destHost` parameter is provided to the `ipFilterList=mod` action within the `netis.cgi` interface, exploiting widthless `sscanf` conversions before authentication. The Boa web server, running with root privileges, would then execute the CGI environment, leading to potential compromise.

Root access to the device.
Oversized `destHost` parameter sent remotely.
Complete device compromise and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Netis NC63 firmware likely impacts network infrastructure teams responsible for edge devices and may require coordination with vendor management. The first practical step is to identify all deployed Netis NC63 devices, confirm their internet reachability and business criticality, and then engage the accountable owner to plan remediation or apply temporary mitigations.

Network and infrastructure teams own this.
Verify device internet exposure and criticality.
Plan vendor-assisted firmware update.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Netis NC63 device?

The Netis NC63 is a consumer router typically used as an edge gateway to connect home or small office networks to the internet. It relies on firmware, specifically the Boa web server, to host a management interface that allows administrators to configure network settings, such as IP filtering, through a web browser.

What does CVE-2026-76071 mean?

This is a stack-based buffer overflow, classified as CWE-121. In plain English, the software fails to check the size of incoming data before saving it to a reserved memory area called the stack. By sending an oversized value to a specific request parameter, an attacker can overwrite nearby memory, causing the system to execute unauthorized commands instead of its normal tasks.

How is this vulnerability triggered?

An attacker triggers this by sending a web request to the 'netis.cgi' interface using the 'ipFilterList=mod' action with an excessively long 'destHost' parameter. The flaw occurs because the program uses a conversion function that does not limit input length, and this happens before the router checks if the user is authorized to perform the action.

Do I need to worry about this if my router is internal?

According to Halo Surface Signal, this vulnerability is most concerning for devices directly connected to the public internet, as the vulnerable management interface is exposed by default. While internal-only devices face a lower immediate risk of external attack, they remain inherently flawed and could still be compromised by a malicious actor who has already gained access to your local network.

What should I do if I use Netis NC63 routers?

First, create an inventory of all Netis NC63 units in your environment to understand your footprint. Confirm which devices are accessible from the internet versus those strictly on internal segments. Finally, coordinate with your infrastructure team to check for official vendor firmware updates and prepare to apply them as the primary way to resolve the underlying code vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.