Netcore NR256CN CVE-2026-111712

Exploitation requires sending HTTP requests to the NR256CN management interface where the request URI is prefixed with a recognized public route - specifically a path beginning with l7_web_auth.cgi or an .ico route - causing the authentication layer to treat the request as public while still dispatching it to a protected management CGI handler. No credentials, user interaction, or non-default configuration is needed (PR:N/UI:N). The principal limiting factor is network reachability of the management interface: on a typical deployment this is LAN-only, so unauthenticated remote attack from the internet requires that WAN-side/remote administration be exposed. Impact is bounded to limited confidentiality and integrity of router management functions (VC:L/VI:L), with no availability impact.

This is a medium-severity (CVSS 4.0 base 6.9) authentication bypass (CWE-288, alternate path/channel) in the Netcore NR256CN router. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack requiring no user interaction, which is consistent with the description - reaching protected management CGI handlers simply by prefixing the URI with a public route. Impact is capped at VC:L/VI:L/VA:N (limited confidentiality and integrity, no availability impact), which prevents this from being a critical-tier issue despite the trivial exploitation path. No EPSS score was provided in the input, the CVE is NOT on CISA KEV, and no exploit code is identified - the two references are a VulnCheck advisory and a GitHub write-up documenting the technique, not weaponized code. The practical risk is tempered primarily by exposure: routers like this are usually administered over the LAN, so network reachability of the management interface (e.g., WAN-side remote management enabled) is the real gating factor rather than any technical precondition. Treat as a real but second-tier priority: exploitation is easy where the interface is reachable, but blast radius per host is limited and there is no evidence of active exploitation or mass-scanning at this time.

An attacker with network access to the router's web management interface sends an HTTP request to a protected management CGI handler, but prefixes the path with a public route such as l7_web_auth.cgi or an .ico route. The authentication check is bypassed and the handler executes without credentials, letting the attacker read or alter router management state. No public exploit code is identified, though a public write-up documents the exact path-prefix technique.