CVE-2026-112016

Executive Summary

CVE-2026-112016 is an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server shipped on Netcore NR256CN routers through firmware version 1.5.140116. A remote, unauthenticated attacker can write attacker-controlled content into the update/restore staging files /tmp/boa_temp.update and /tmp/boa_temp.para by POSTing to a non-existent .cgi pathname, tampering with pending firmware updates or configuration restores, or inducing a denial-of-service condition. No patch is currently available, and there is no public PoC, exploit code, or Nuclei template at the time of writing.

Technical Analysis

The NR256CN is a Netcore router platform whose management interface is served by a Boa-derived HTTP daemon located at /bin/boa. Boa is a lightweight, historically single-purpose embedded web server widely reused across consumer and SMB network appliances; its request-handling routines (path resolution, CGI dispatch, and temporary-file staging for uploads) are a common source of embedded-device weaknesses.

This vulnerability is classified as CWE-306 (Missing Authentication for Critical Function). Per the NVD description, the flaw resides in the way /bin/boa handles requests to non-existent .cgi pathnames. When a POST is directed at a .cgi path that does not resolve to a real CGI handler, the server does not reject the request but instead routes the submitted body into staging files used by the device's update and restore workflows — specifically /tmp/boa_temp.update and /tmp/boa_temp.para. Because this write path is reachable without any authentication challenge or session token, an unauthenticated remote client can populate those files with arbitrary content.

The security impact stems from what those staging files subsequently feed:

• /tmp/boa_temp.update is associated with pending firmware-update handling.
• /tmp/boa_temp.para is associated with pending configuration-restore (parameter) handling.

By controlling the content written into these staging locations, an attacker can corrupt or tamper with an in-progress or subsequently-triggered firmware update or configuration restore. The precise parsing, validation, and consumption logic of these files is not disclosed in the available description; the description does not establish code-execution or privilege-escalation outcomes, so impact is bounded to the integrity of update/restore operations and availability.

The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L is consistent with this reading: network-reachable, low complexity, no privileges, no user interaction, no confidentiality impact, low integrity impact, and low availability impact, all within the vulnerable component's security scope. The omission of a confidentiality metric reinforces that this is a write-tampering/availability issue rather than an information-disclosure bug.

Insufficient technical detail is available to identify the exact request parsing branch, buffer handling, or filename-mapping code responsible; the description characterizes the trigger (POST to a non-existent .cgi pathname) and the effect (write to the two /tmp staging files) but not the underlying implementation.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (unauthenticated file write via CGI path handling) and the specific artifacts named in the NVD description.

1. Reconnaissance / target identification. An attacker scans for internet-exposed Netcore NR256CN management interfaces. Because the web server is /bin/boa, the HTTP responses and default pages are characteristic of Boa-derived devices. Shodan-style queries on page titles, HTML markers, or product strings identify candidate hosts. Exposure requires the management interface to be reachable — in practice, devices with WAN-side management enabled or misconfigured port-forwarding.

2. Triggering the flaw. The attacker crafts an HTTP POST to a .cgi pathname that does not resolve to an actual CGI handler on the device. Rather than returning an error and discarding the body, the vulnerable server processes the request in a way that writes the supplied content into /tmp/boa_temp.update or /tmp/boa_temp.para. No credentials, session cookie, or prior authentication is required. The exact CGI path string and body format are not specified in the available description and would require probing of a live device to determine.

3. Payload / execution method. At the vulnerability-class level, the attacker's HTTP body is the arbitrary content written into the staging file. By targeting /tmp/boa_temp.update, the attacker seeds attacker-controlled data into the pending firmware-update staging area; by targeting /tmp/boa_temp.para, the attacker seeds data into the pending configuration-restore staging area. The effect depends on whether and when the device's update or restore routine consumes these files.

4. Post-exploitation impact. Depending on the device's update/restore workflow timing, outcomes include: tampering with or corrupting a pending firmware update; tampering with a configuration restore so that restored settings do not match the legitimate administrator's intent; and denial of service (e.g., via malformed staged content causing the update/restore routine to fail or the device to become unstable). The description does not establish code execution, persistence, or credential theft as demonstrated outcomes; those should not be assumed.

Impact Assessment

Affected systems: Netcore NR256CN routers running firmware up to and including 1.5.140116. Devices with the management web interface reachable from untrusted networks (WAN management enabled, or exposed via NAT/port-forwarding) are at direct risk; LAN-only deployments reduce exposure to on-path or internal attackers.

CVSS interpretation (6.5 Medium):

• AV:N — exploitable across the network.
• AC:L — no special conditions beyond sending a crafted HTTP request.
• PR:N — no authentication required.
• UI:N — no victim interaction.
• S:U — impact confined to the router.
• C:N — no confidentiality impact.
• I:L — limited integrity impact (staging-file content control).
• A:L — limited availability impact (potential DoS of update/restore).

Business impact: The primary risks are integrity and availability of device lifecycle operations. A tampered update/restore can leave a device in an inconsistent state, disrupt managed rollout of firmware, or force recovery/replacement actions. Denial-of-service outcomes can take a gateway offline, interrupting connectivity for downstream users. Because the flaw provides no confidentiality impact and no demonstrated code execution, it is not a direct data-breach vector on its own, but it can be chained with operational disruption. There is no CISA KEV listing and no known in-the-wild exploitation reported, so current likelihood is assessed as low-to-moderate pending disclosure of PoC or scanning activity.

Blast radius: Per-device, but IoT/embedded routers are frequently deployed in fleets; a single exposure pattern (WAN management left enabled) can affect many identical units simultaneously.

Detection Guidance

Sigma Rule

title: Netcore NR256CN Boa Unauthenticated File Write via Non-Existent CGI Path
id: 7f3c2a91-4b6e-4c1a-9d2f-nr256cn01
status: experimental
description: Detects HTTP POST requests to non-existent .cgi paths targeting Netcore NR256CN Boa web server, consistent with CVE-2026-112016 exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-112016
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|endswith: '.cgi'
  filter_known:
    cs-uri-stem:
      - '/apply.cgi'
      - '/login.cgi'
  condition: selection_method and selection_uri and not filter_known
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate CGI endpoints not listed in filter_known
level: medium

YARA Rule

rule CVE_2026_112016_Netcore_NR256CN_Boa_Staging
{
    meta:
        description = "Detects references to Netcore NR256CN Boa update/restore staging artifacts abused in CVE-2026-112016"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-112016"
        date = "2026-01-01"
    strings:
        $s1 = "/tmp/boa_temp.update" ascii wide
        $s2 = "/tmp/boa_temp.para" ascii wide
        $boa = "boa_temp" ascii wide
        $bin = "/bin/boa" ascii wide
    condition:
        ($bin and ($s1 or $s2)) or (2 of ($boa*)) or ($s1 or $s2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-112016 Netcore NR256CN Boa unauthenticated POST to suspicious .cgi path"; flow:established,to_server; http.method; content:"POST"; http.uri; pcre:"/\.cgi(?:\?|$)/i"; classtype:attempted-admin; reference:cve,2026-112016; sid:2026112016; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "POST" and
     network.protocol == "http" and
     endsWith(network.protocol, "http")]
  [network where http.request.method == "POST"]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=stream:http
| eval uri=coalesce(uri, url, cs_uri_stem)
| eval method=coalesce(method, http_method, cs_method)
| where method="POST" AND match(uri, "(?i)\.cgi($|\?)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, dest
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-112016,netcore_nr256cn,">
  <rule id="1120161" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.request.method">POST</field>
    <regex type="pcre2">(?i)\.cgi(?:\?|$)</regex>
    <description>CVE-2026-112016: possible Netcore NR256CN Boa unauthenticated POST to non-existent .cgi path</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source; no vendor fix identified).

1) Immediate mitigations

• Disable remote/WAN administration of the router's web interface; restrict /bin/boa management access to trusted management VLANs or specific admin IPs via firewall rules.
• If WAN management must remain enabled, front the appliance with a filtering reverse proxy or ACL that only permits expected, valid CGI endpoints and rejects POSTs to unknown .cgi paths.
• Monitor for POST requests to non-existent .cgi paths and for abnormal writes to /tmp/boa_temp.update and /tmp/boa_temp.para where local logging is available.
• Avoid initiating firmware-update or configuration-restore operations over interfaces reachable from untrusted networks until an interim control is in place, to prevent tampering with staged content.

2) Patch/upgrade steps

• No patch is available as of this report. Contact Netcore support for status and any available firmware beyond 1.5.140116; assess replacement with a current, supported model if the product is end-of-life.
• Before applying any firmware, verify its integrity and authenticity through a trusted channel and validate checksums, since the staging mechanism itself is the attack surface.
• After any update/restore, verify device configuration and firmware version to confirm the operation was not tampered with.

3) Long-term hardening

• Adopt network segmentation to keep router/IoT management planes off untrusted networks by default (zero-trust for device management).
• Prefer devices that require authenticated, signed firmware updates and configuration restores.
• Include embedded-device firmware in asset inventory and vulnerability-management reporting; enforce a supported-firmware policy and timely replacement of end-of-life models.
• Add web-server request logging on the device (if supported) to a central SIEM for ongoing detection of unusual .cgi POST activity.

References

• NVD — CVE-2026-112016: https://nvd.nist.gov/vuln/detail/CVE-2026-112016
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• Netcore (vendor) support site — verify current firmware/advisory status: https://www.netcore.in/
• CISA KEV catalog (CVE-2026-112016 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or evidence of active in-the-wild exploitation or named threat-actor campaigns is available for CVE-2026-112016 at the time of writing.