CVE-2026-111710

Executive Summary

CVE-2026-111710 is a NULL pointer dereference vulnerability in the Boa web server component of the Netcore NR256CN router, affecting firmware versions through 1.5.140116. An unauthenticated remote attacker can crash the main Boa process by sending a malformed HTTP Basic Authorization header that lacks a colon delimiter to a protected route such as /router/get_user_type.cgi, resulting in a denial-of-service condition that renders the device management interface inaccessible. With a CVSS base score of 7.5 (High) and no available patch, this vulnerability represents a significant availability risk for organizations deploying the affected Netcore hardware in edge or SOHO network positions.

Technical Analysis

The vulnerability resides in the user_auth() function of the Boa web server, a lightweight embedded HTTP daemon commonly deployed in consumer and small-business router firmware. The flaw is classified as CWE-476: NULL Pointer Dereference, and manifests during the parsing and validation of HTTP Basic Authorization headers.

In a standards-compliant implementation, an HTTP Basic Authorization header carries a base64-encoded credential string formatted as "username:password". The server-side authentication logic is expected to locate the colon separator, extract the user-supplied username and password components, and compare them against configured credentials stored locally on the device. The user_auth() function in the affected Boa build appears to dereference a pointer derived from the result of locating that colon without first validating that the colon exists, and without validating that the decoded credential string is of sufficient length.

The NVD description explicitly notes that an attacker can supply a Basic Authorization value lacking a colon, such as one that decodes to a single character. In that case the credential parsing routine receives a string with no delimiter. The pointer returned by the delimiter search (which in standard C string handling would be NULL) is then dereferenced or used as the basis for subsequent string operations, triggering a NULL pointer dereference. Because Boa typically runs as a single-process (or minimally multi-process) embedded daemon on resource-constrained hardware, the resulting fault terminates the main Boa process rather than isolating the failure to a single worker thread or connection handler.

The attack surface is the HTTP management interface exposed on the device. Protected routes — /router/get_user_type.cgi is named directly in the advisory — invoke the authentication routine before serving content. The reachability of user_auth() from an unauthenticated request is the critical structural weakness: the vulnerable code path is exercised during the authentication check itself, meaning the attacker does not need any valid credentials to reach the faulting logic. This is consistent with the CVSS vector, which specifies AV:N (network-reachable), AC:L (no specialized conditions), PR:N (no privileges required), and UI:N (no user interaction). The vector carries C:N and I:N for confidentiality and integrity, reflecting that the flaw is purely an availability impact, and A:H for the high availability impact stemming from a full process termination that denies management access.

No information in the available data indicates a memory corruption path beyond the NULL dereference, so this should be treated as a denial-of-service condition rather than a code-execution primitive. No CNA title content, affected-version list, OSV package data, or patch source was provided beyond the firmware ceiling of 1.5.140116, so the precise commit that introduces or resolves the flaw cannot be established from this dataset.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-111710. The attack chain described below is strictly inferred from the vulnerability class (CWE-476) and the mechanics stated in the NVD description.

1. Reconnaissance and target identification. The attacker scans for exposed Netcore NR256CN management interfaces reachable over the network. Because the affected component is Boa, a web server fingerprint, HTTP banner, or page title associated with the device identifies candidates. Public scanning services such as Shodan can be used to locate internet-facing instances matching the device characteristics. No authentication is required at this stage.

2. Triggering the flaw class. The attacker crafts an HTTP request to a protected route — for example /router/get_user_type.cgi — and supplies a Basic Authorization header whose base64-decoded payload contains no colon separator. As described, a value that decodes to a single character is sufficient. When the request reaches the authentication routine in the Boa user_auth() function, the delimiter search fails and the subsequent string handling dereferences a NULL pointer.

3. Payload/execution method. At the vulnerability-class level, the payload is an HTTP GET (or equivalent) request carrying the malformed Authorization header. The delivery mechanism is a single unauthenticated HTTP transaction. No credential, session token, prior interaction, or client-side scripting is required — the malformed header is itself the trigger. The attacker can replay this request at will, and each request that reaches user_auth() is expected to fault the authentication path.

4. Post-exploitation impact. Successful triggering kills the main Boa process on the device. The management web interface becomes unavailable, denying administrative access to legitimate operators. Depending on the device's init behavior, the daemon may or may not be automatically restarted; if it is restarted automatically, the attacker can sustain the denial of service by continuously replaying the malformed request. Crucially, the described impact is availability-only: there is no stated loss of confidentiality or integrity, no credential exfiltration, and no code execution. The blast radius is limited to the management-plane availability of the affected device, though persistent management blackout on an edge router can impede incident response and reconfiguration during a broader attack.

Impact Assessment

The CVSS 3.1 base score is 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Breaking this down by metric:

• Attack Vector (Network): the management interface is reachable across a network boundary, meaning the attacker needs no local access.
• Attack Complexity (Low): the trigger is a simple malformed header with no race condition, no specialized configuration, and no knowledge of secrets.
• Privileges Required (None): the vulnerable user_auth() path is exercised before authentication succeeds, so no credentials are needed.
• User Interaction (None): exploitation is entirely server-driven; no victim must click, browse, or approve anything.
• Scope (Unchanged): the impact is confined to the vulnerable component rather than crossing a security authority boundary.
• Confidentiality (None) and Integrity (None): the vulnerability does not expose or alter data.
• Availability (High): the main Boa process is terminated, denying management interface access.

Business impact centers on availability and manageability of the affected router. For a SOHO or branch-office deployment, loss of the management interface blocks configuration changes, monitoring, and routine administration. Sustained denial of service can also interfere with remediation during a larger incident, effectively blinding defenders to the device's state. Where the device functions as a network edge or gateway, loss of management access may complicate failover and recovery operations. The blast radius is per-device; there is no evidence in the provided data that the flaw propagates laterally or affects other components. Because the exploit requires only a single unauthenticated request and no public exploitation has yet been observed, the current threat level should be characterized as potential rather than actively exploited. CISA KEV status is NO, and FIRST.org has not yet assigned an EPSS score.

Detection Guidance

Sigma Rule

This Sigma rule targets HTTP request logging that captures malformed Basic Authorization headers. Because Sigma operates on event logs, the rule keys on URL path, header presence, and known-good Basic header structure to flag anomalies. Deployment should be tuned to the specific logging pipeline (reverse proxy, WAF, or device syslog) that captures the management request stream.

title: Netcore NR256CN Boa user_auth NULL Pointer Dereference DoS Attempt
id: 3f9c1a72-5b6e-4c2d-9a11-7e0b4d8c2f01
status: experimental
description: Detects HTTP requests to Netcore Boa protected routes carrying a malformed Basic Authorization header lacking a colon delimiter, consistent with CVE-2026-111710 triggering a NULL pointer dereference in user_auth().
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111710
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.111710
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/router/get_user_type.cgi'
  selection_auth:
    cs-Authorization|startswith: 'Basic '
  filter_valid:
    cs-Authorization|re: '^Basic [A-Za-z0-9+/=]+$'
  condition: selection_path and selection_auth and not filter_valid
fields:
  - c-ip
  - cs-uri-stem
  - cs-Authorization
  - sc-status
falsepositives:
  - Legitimate clients with malformed credential strings due to third-party tooling bugs
level: high

YARA Rule

YARA operates on files and memory. This rule targets the Boa binary or firmware image associated with the affected Netcore build. Because no binary hashes or exact symbols were provided beyond the function name user_auth(), the rule uses string-based matching and should be validated against a reference firmware image before production deployment.

rule CVE_2026_111710_Netcore_Boa_user_auth
{
    meta:
        description = "Detects Netcore Boa web server artifacts associated with CVE-2026-111710 NULL pointer dereference in user_auth()"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-111710"
        date = "2026-01-01"
        severity = "high"

    strings:
        $fn = "user_auth" ascii
        $route = "/router/get_user_type.cgi" ascii
        $basic = "Authorization" ascii nocase
        $boa = "Boa" ascii
        $netcore = "Netcore" ascii nocase
        $version = "1.5.140116" ascii

    condition:
        ($fn and ($route or $basic)) or
        ($boa and $netcore and $version)
}

Suricata IDS Rule

This Suricata rule detects the malformed Basic Authorization header sent to the named protected route. It matches HTTP traffic to /router/get_user_type.cgi carrying a Basic Authorization value that is either absent of the expected base64 content or shorter than a valid encoded credential string. Adjust the threshold/flow settings to the sensor deployment.

alert http any any -> any any (msg:"CVE-2026-111710 Netcore NR256CN Boa user_auth malformed Authorization DoS attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/router/get_user_type.cgi"; http.header; content:"Authorization|3a|"; nocase; content:"Basic "; nocase; pcre:"/Authorization\x3a\s*Basic\s+(?:[A-Za-z0-9+\/]{0,7})?\r\n/Hi"; reference:cve,2026-111710; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-111710; classtype:attempted-dos; sid:2026111710; rev:1;)

Elastic Detection

This EQL rule scans HTTP logs from the management interface or an upstream proxy for the malformed header pattern against the protected route. Field names should be mapped to the ECS HTTP fields (http.request.method, url.path, http.request.headers).

sequence by source.ip with maxspan=5s
  [http where url.path == "/router/get_user_type.cgi"
     and http.request.method == "GET"
     and http.request.headers.authorization != null]

Operational note: combine this EQL with a filtering condition that validates the Basic token contains a colon in its decoded form. Where the ECS normalization is unavailable, key on url.path and the presence of an authorization header, then enrich and filter in the detection rule logic.

Splunk SPL Query

This Splunk search looks for repeated requests to the protected route with malformed or malformed-length Basic Authorization headers from a single source, which is consistent with sustained denial-of-service attempts.

index=web OR index=proxy
| search uri_path="/router/get_user_type.cgi"
| eval auth_hdr=coalesce(http_authorization, cs_Authorization, authorization)
| where like(auth_hdr, "Basic %")
| eval b64=trim(replace(auth_hdr, "Basic ", ""))
| eval has_colon=if(match(b64, "="), 1, 0)
| where len(b64) < 8 OR has_colon=0
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status by src_ip uri_path
| where count >= 3
| sort - count

Tune the length threshold and time window to the environment; a base64-encoded "user:pass" string is substantially longer, so short tokens indicate malformed input.

Wazuh OSSEC Rule

This Wazuh XML rule detects the malformed Authorization pattern in web access logs ingested by the manager. Place it in the appropriate local_rules.xml and set the decoder to match the log source.

<group name="web,netcore,cve-2026-111710,">
  <rule id="100710" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/router/get_user_type.cgi</url>
    <match>Authorization: Basic</match>
    <description>CVE-2026-111710: Potential Netcore NR256CN Boa user_auth malformed Basic Authorization DoS attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Operators should pair this rule with a sibling rule that validates the Basic token length and presence of a colon delimiter, then escalate to level 12 when more than a threshold number of matching events arrive within a short interval.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence has been identified from any tracked source, the vendor fix field is N/A, no affected-version fix list is available, and no workarounds are documented. All guidance below is therefore compensating controls and hygiene rather than remediation.

1. Immediate mitigations.

   • Remove the Netcore NR256CN management interface from untrusted network reachability. Restrict access to the Boa web server by source IP allow-listing, firewall rules, or by placing management access behind a VPN or a segregated management VLAN. This directly neutralizes the AV:N vector for remote attackers.
   • Disable remote/web administration if the device supports disabling the WAN-facing management function and if doing so does not break required operations.
   • Where an upstream reverse proxy or WAF is present, reject HTTP requests whose Basic Authorization header decodes to a string lacking a colon, or which are shorter than a plausible credential length. This acts as a virtual patch at the boundary.
   • Monitor for repeated requests to /router/get_user_type.cgi from unexpected sources and alert on the pattern described in the Detection Guidance section.

2. Patch/upgrade steps.

   • No fixed firmware version is documented in this dataset. Contact Netcore support directly to request the current firmware for the NR256CN and to determine whether a version addressing the Boa user_auth() flaw has been released beyond 1.5.140116.
   • Do not assume that any available firmware resolves this CVE without confirming with the vendor; the patch confidence for this report is 0/4.
   • Where the device has reached end-of-support and no fix will be forthcoming, plan replacement with a supported platform as the definitive remediation.

3. Long-term hardening.

   • Inventory all deployed Netcore NR256CN units and record firmware versions, then treat the 1.5.140116 boundary as the exposure threshold for this finding.
   • Enforce management-plane segmentation as a standing policy for all edge and SOHO network devices; no management interface should be reachable from untrusted networks.
   • Adopt a replacement cadence for end-of-support networking hardware so that availability-impact vulnerabilities on unpatched devices do not persist indefinitely.
   • Continuously monitor vendor advisories and the NVD entry for CVE-2026-111710 for an eventual fixed firmware release, and re-evaluate patch confidence when that evidence appears.

References

• NVD — CVE-2026-111710: https://nvd.nist.gov/vuln/detail/CVE-2026-111710
• CWE-476: NULL Pointer Dereference — https://cwe.mitre.org/data/definitions/476.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-111710 not listed; status NO as of this report) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored as of this report) — https://www.first.org/epss/

Known threat actor campaigns or exploit-in-the-wild evidence: none identified in the provided dataset. No public proof-of-concept, no Nuclei template, and no exploit code are available, and the CVE is not present in CISA KEV. The vulnerability should be treated as a latent, unpatched availability risk rather than an actively exploited threat at this time.