Netcore NR256CN EUVD-2026-103002

Exploitation requires network reachability to the Boa-based web management interface of a Netcore NR256CN router (firmware through 1.5.140116) and the presence of auth-protected CGI endpoints such as /router/get_user_type.cgi. The specific trigger is a Basic Authorization header whose base64-decoded value contains NO colon separator (e.g., decoding to a single character), which the user_auth() parser mishandles. No authentication, user interaction, or special non-default configuration is required (PR:N/UI:N). The principal LIMITING factor is exposure of the management interface: these interfaces are typically LAN-side, so remote (WAN) exploitation depends on the admin interface being externally reachable; impact is limited to availability (service crash), with no data disclosure or code execution.

This is a genuine but bounded availability threat, not a confidentiality/integrity compromise. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VA:H and VC:N/VI:N confirms an unauthenticated, network-reachable, low-complexity attack whose ONLY impact is denial of service - crashing the Boa web server process. The 8.7 score is driven entirely by the high availability impact combined with trivial reachability; there is no code execution or data exposure. No EPSS score was provided in the input, and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation - the elevated score reflects ease of attack, not observed abuse. The practical risk is tempered by product footprint: Netcore NR256CN is a niche SOHO/consumer router, and management interfaces are typically LAN-facing, so real-world exposure depends heavily on whether the web management interface is reachable from the attacker's network (e.g., WAN-exposed admin). Signals are internally consistent - network vector in the CVSS matches the description's 'send a Basic Authorization value' remote trigger - so no AV conflict exists. Bottom line: a reliable, easy DoS against a specific router model, prioritize only where these devices are deployed and their management interface is exposed.

An attacker with network access to the router's management interface sends an HTTP request to a protected CGI route (e.g., /router/get_user_type.cgi) carrying a Basic Authorization header whose base64 value decodes to a string lacking a colon (such as a single character). The user_auth() function dereferences a NULL pointer while parsing the malformed credential, crashing the main Boa process and rendering the entire management interface unavailable until reboot. A detailed public technical write-up exists (VulnCheck advisory and a public reference repository), making the crash trivial to reproduce.