CVE-2026-111711

Executive Summary

CVE-2026-111711 is a pre-authentication stack buffer overflow (CWE-121) in the Boa web server component of Netcore NR256CN routers running firmware through version 1.5.140116. The flaw resides in the user_ok() function, which copies Basic-authentication usernames into a fixed 64-byte stack buffer using unbounded strcpy() calls, allowing an unauthenticated remote attacker to overflow the buffer by supplying a username longer than 63 bytes. With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation can crash the main Boa process (denial of service) or potentially achieve remote code execution, making this a critical exposure for any internet-facing or laterally reachable NR256CN device.

Technical Analysis

The vulnerability is a classic stack-based buffer overflow in a network-facing authentication handler. The Boa web server embedded in Netcore NR256CN firmware implements HTTP Basic authentication, and the user_ok() function is responsible for validating supplied credentials. According to the NVD description, this function copies the Basic-auth username into a 64-byte stack buffer using strcpy() without enforcing a length bound. Because strcpy() writes until a NUL terminator, any username exceeding 63 bytes (plus terminator) overwrites adjacent stack memory.

Key technical characteristics:

• Authentication context: The overflow occurs during authentication processing, meaning no valid credentials are required. The mere act of hitting a protected route with an oversized username in the Authorization: Basic header triggers the vulnerable code path. This is why the CVSS vector shows PR:N (no privileges required) and AC:L (low attack complexity).
• Attack surface: Any protected /router/*.cgi route on the Boa server invokes user_ok(). Attackers do not need to know a specific valid endpoint — any route under the protected /router/ path that enforces Basic auth will call the vulnerable function.
• Root cause (CWE-121): Unbounded copy of attacker-controlled input into a fixed-size stack buffer. The 64-byte buffer is exceeded by any username of 64 bytes or more; the description explicitly notes a username longer than 63 bytes is sufficient.
• Consequence: A controlled write past the buffer boundary corrupts stack data. Depending on layout, this reliably causes a crash of the main Boa process; under favorable conditions (attacker-influenced stack contents and control-flow data), it may be leveraged toward code execution. The CVSS impact subscore of High across Confidentiality, Integrity, and Availability reflects the potential for full compromise, not merely DoS.

The pre-authentication nature and the simplicity of the trigger (a single crafted HTTP request) make this a high-severity, low-skill-floor vulnerability. No public PoC, exploit code, or Nuclei template is currently known, so weaponization details remain unconfirmed; the mechanics above are derived strictly from the vendor/authoritative description of the user_ok() strcpy() overflow.

Note: The description is specific about the function (user_ok()), the mechanism (strcpy() into a 64-byte buffer), and the surface (/router/*.cgi), but does not disclose offset-to-return-address, mitigations present (ASLR/NX/stack canaries), or exact firmware build behavior. Those details are not asserted here.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (pre-auth stack overflow via HTTP Basic auth) and the details provided; no public PoC exists, so this describes the class-level approach rather than a validated exploit.

1. Reconnaissance / target identification. An attacker identifies internet-facing or internally reachable Netcore NR256CN devices, typically by fingerprinting the Boa web server and Netcore router management interface. Exposure on WAN-side management ports or reachable LAN segments is the primary targeting criterion.

2. Triggering the flaw. The attacker sends an HTTP request to any protected /router/*.cgi route. The request includes an Authorization: Basic <base64> header whose decoded username exceeds 63 bytes. On receipt, Boa invokes user_ok(), which strcpy()s the oversized username into the 64-byte stack buffer, overflowing it. No credentials are needed; the overflow occurs before authentication succeeds.

3. Payload/execution (vulnerability-class level). In the minimal case, the oversized username itself is sufficient to corrupt the stack and crash the Boa process, yielding denial of service. For code-execution attempts, an attacker would craft the username contents to overwrite saved stack data such as a return address or function pointer with attacker-controlled values, potentially redirecting execution. The feasibility of reliable RCE depends on memory protections (ASLR, NX, stack canaries) and stack layout, which are not disclosed in the available data. Any such step is a class-level inference, not a confirmed exploit.

4. Post-exploitation impact. If only crash is achieved, the impact is loss of the web management service (and potentially device instability). If code execution is achieved, the attacker could run code in the Boa process context — typically with router/network privileges — enabling configuration tampering, credential theft, traffic manipulation, persistence, and use of the device as a pivot into the internal network.

The attack is low-complexity and unauthenticated, consistent with the CVSS AC:L/PR:N subscores.

Impact Assessment

CVE-2026-111711 carries a CVSS v3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Interpretation of each metric:

• AV:N (Network): Exploitable remotely across a network boundary — no physical or adjacent-only access required.
• AC:L (Low complexity): Triggering requires only a crafted HTTP request; no race conditions or special conditions are implied.
• PR:N (No privileges): The vulnerable user_ok() path executes before authentication, so no valid account is needed.
• UI:N (No user interaction): No victim action is required.
• S:U (Unchanged scope): Impact is confined to the Boa process/device context.
• C:H / I:H / A:H: High impact to confidentiality, integrity, and availability — reflecting potential full device compromise or, at minimum, service disruption.

Blast radius and business impact: Netcore NR256CN devices are typically deployed as edge/access routers in SMB, branch, or residential environments. A compromised or crashed router is a high-leverage event: it can sever connectivity (availability loss), expose internal network traffic and credentials, enable man-in-the-middle or DNS manipulation, and serve as an initial foothold for lateral movement into trusted networks. Because the flaw is pre-authentication, exposure is amplified wherever management interfaces are reachable from untrusted networks. The presence of hundreds or thousands of such devices in aggregate deployment means a single reliable exploit could be leveraged at scale by botnet operators seeking router footholds.

Detection Guidance

Sigma Rule

title: Netcore NR256CN Boa user_ok Stack Overflow Attempt (CVE-2026-111711)
id: 7b3d9c1e-2f4a-4c8b-9a1e-netcore11171
status: experimental
description: Detects HTTP requests with abnormally long Basic-auth usernames targeting protected /router/*.cgi routes, indicative of exploitation of the pre-auth stack overflow in Boa user_ok().
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111711
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: boa
detection:
  selection_path:
    cs-uri-stem|startswith: '/router/'
    cs-uri-stem|endswith: '.cgi'
  selection_auth:
    cs-method: 'GET'
    cs-Authorization|startswith: 'Basic '
  condition: selection_path and selection_auth
  # Note: pair with length-based logic in SIEM to flag decoded usernames >63 bytes
fields:
  - c-ip
  - cs-uri-stem
  - cs-Authorization
falsepositives:
  - Legitimate clients with unusually long usernames (rare)
level: high

YARA Rule

rule CVE_2026_111711_Boa_user_ok_Overflow
{
    meta:
        description = "Detects indicators of Netcore NR256CN Boa user_ok() stack overflow exploitation via oversized Basic-auth usernames"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-111711"
        cve = "CVE-2026-111711"
        date = "2026-01-01"

    strings:
        $basic = "Authorization: Basic " ascii nocase
        $router = "/router/" ascii nocase
        $cgi = ".cgi" ascii nocase

    condition:
        $basic and $router and $cgi
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-111711 Netcore NR256CN Boa user_ok Stack Overflow Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/router/"; http.uri; content:".cgi"; http.header; content:"Authorization|3a 20|Basic "; pcre:"/Authorization\x3a\s*Basic\s+[A-Za-z0-9+\/=]{88,}/i"; classtype:attempted-admin; reference:cve,2026-111711; sid:2026111711; rev:1;)

(Note: a Base64 Basic-auth username of 64 bytes encodes to 88 characters; this threshold flags clearly oversized credential headers.)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method == "GET" and http.request.uri like "/router/*" ]
  [ network where http.request.headers.authorization like "Basic *" ]

(Supplement with a where clause on decoded username length > 63 in enrichment pipelines if header decoding is available.)

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=boa
| where match(uri, "^/router/.*\.cgi")
| eval auth_b64 = mvindex(split(header_Authorization, " "), 1)
| eval auth_decoded = base64decode(auth_b64)
| eval user_len = len(mvindex(split(auth_decoded, ":"), 0))
| where user_len > 63
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, user_len
| sort - count

Wazuh OSSEC Rule

<group name="web,netcore,boa,cve-2026-111711">
  <rule id="1117110" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <regex match="/router/.*\.cgi" type="pcre2">/router/.*\.cgi</regex>
    <description>CVE-2026-111711: Request to protected Boa /router/*.cgi route - possible user_ok overflow trigger</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or advisory is presently identified, and no affected-version list beyond "through 1.5.140116" has been confirmed.

1) Immediate mitigations

• Remove all Netcore NR256CN management interfaces from untrusted networks. Disable WAN-side admin access and restrict /router/ and .cgi endpoints to a trusted management VLAN or bastion host.
• Place affected devices behind a firewall/WAF that inspects HTTP headers and rejects requests containing oversized or malformed Authorization: Basic values (e.g., username >63 bytes).
• Where the device is non-critical and unmanaged, consider network segmentation to isolate it from sensitive internal assets.
• Monitor and log for the detection signatures above; treat any hit as a potential exploitation attempt.

2) Patch/upgrade steps

• There is currently no available patch. Check the Netcore vendor support channel and NVD entry for firmware updates addressing CVE-2026-111711.
• If no fix is forthcoming, consider replacing the device with a supported platform. End-of-support or unmaintained router firmware represents a persistent, unpatchable risk.
• Track the NVD record for status changes and any vendor advisory that may be published later.

3) Long-term hardening

• Enforce a device lifecycle policy that mandates supported, patchable firmware and defined end-of-life replacement.
• Disable unused services (notably remote/web management) by default.
• Apply defense-in-depth: egress filtering, network segmentation, and least-privilege network access to management planes.
• Deploy continuous detection for pre-auth overflow patterns against all edge devices, since similar legacy web servers (Boa) are common in embedded systems.

References

• NVD — CVE-2026-111711: https://nvd.nist.gov/vuln/detail/CVE-2026-111711
• CWE-121 Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (no score currently published for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or CISA KEV entry is currently associated with CVE-2026-111711. No threat-actor campaign or in-the-wild exploitation evidence has been identified as of this report. CVE is not presently listed in CISA KEV.