Netcore NR256CN: NULL pointer dereference in Boa web server causes denial of service
Summary
Netcore NR256CN devices through firmware 1.5.140116 contain a NULL pointer dereference in the Boa web server's user_auth() function. An unauthenticated attacker can send a malformed Basic Authorization header, for example one that decodes to a value without a colon, to crash the main Boa process. This makes the device's management interface unavailable until it recovers, and the CVSS vector rates only availability impact.
Affected
- Netcore NR256CN through firmware 1.5.140116 (NR256CN-V1.5.140116.bin)
Fixed in
- Unverified: a third-party source states that version 1.5.140117 or later fixes the issue. No vendor advisory was found; confirm with Netcore.
Workaround
- No vendor-documented workaround found.
- Block WAN access to the web management interface and restrict it to trusted LAN segments.
- Place the device behind a firewall that does not forward management traffic.
Exploitation
- Exploited in the wild: no evidence found. CISA SSVC: exploitation none, automatable yes.
- A public reference document exists; the researcher has withheld proof-of-concept details.
- Authentication is not required and the attack is network-based.
Our recommendation
- Inventory all NR256CN devices and their firmware versions.
- Remove any internet or untrusted-network exposure of the management interface now.
- Ask Netcore whether a fixed firmware exists and apply it once confirmed.
- If no fix is available, plan replacement of the device.
- Monitor for unexpected reboots or management interface outages.
- Also track the related CVE-2026-111711 and CVE-2026-112016 for the same device, as they are more severe.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Public reference document (GitHub) github.com
- VulDB CVE-2026-111710 vuldb.com
- Strix CVE-2026-111710 www.strix.ai
- HOL Guard CVE-2026-111710 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:11.
Original description (NVD)
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.