EUVD-2026-64921
GHSA-7gc7-3gxp-v85m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated, network-reachable, low-complexity overflow of the pre-login CGI (AV:N/AC:L/PR:N/UI:N) yielding root code execution, so C/I/A all High; scope unchanged as impact stays within the device.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi. Attackers can exploit the custom Base64 decoder's lack of output length validation against the fixed-size stack buffer to achieve remote code execution with root privileges, as the Boa web server executes the CGI environment as root.
AnalysisAI
Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized Base64-encoded password to the login handler in /bin/netis.cgi, whose custom Base64 decoder writes past a fixed-size stack buffer. Because the Boa web server runs CGI processes as root, successful exploitation yields full device takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the NC63 web management interface and the ability to reach the login handler at /bin/netis.cgi - the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication and no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA all High) describes network-reachable, unauthenticated, low-complexity exploitation with total impact, and the presence of public exploit code sharply lowers the barrier to real-world abuse. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans for internet-exposed Netis NC63 login pages and sends a single crafted HTTP login request whose password field is an over-long Base64 string; the custom decoder overflows the fixed stack buffer in /bin/netis.cgi, overwrites the saved return address, and executes attacker-supplied shellcode as root under the Boa web server. Public exploit code (ozcanpng's GitHub repo and write-up) means this requires little custom development, and no authentication or user interaction is needed. |
| Remediation | No vendor-released patch is identified at time of analysis, and no fixed firmware version is present in the input, so upgrade to a corrected build cannot be specified yet - monitor https://www.netis-systems.com/products/NC63.html and the VulnCheck advisory (https://www.vulncheck.com/advisories/netis-nc63-stack-buffer-overflow-via-login-password-parameter) for a firmware release above V3.0.0.3327. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, execute a network scan to identify all Netis NC63 devices running firmware V3.0.0.3327 or earlier, document their network locations and business functions, and prepare isolation plans. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today