Netcore NR256CN EUVD-2026-103003

Exploitation requires network reachability to the router's Boa web server and a request to any password-protected /router/*.cgi route, supplying an HTTP Basic-auth username longer than 63 bytes to overflow the fixed 64-byte stack buffer in user_ok(). No credentials, no user interaction, and no non-default configuration are needed - the vulnerable code path is in the pre-authentication Basic-auth handling itself (PR:N/UI:N). The primary limiting factor is exposure: the attacker must be able to reach the device's HTTP management interface, so the realistic risk is far higher where the web interface is exposed to the WAN/Internet and substantially lower where it is restricted to the LAN. Affected scope is Netcore NR256CN firmware through 1.5.140116.

This is a genuinely high-priority flaw on the signals that are present, though it is partly a worst-case projection. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, pre-authentication condition requiring no user interaction, and the description confirms the pre-auth nature (an over-length Basic-auth username to any /router/*.cgi route). CWE-121 (stack-based buffer overflow) via unbounded strcpy() into a fixed 64-byte buffer is a classic, reliably triggerable memory-corruption pattern, which supports the low attack complexity rating. However, note a signal nuance: VC:H/VI:H/VA:H reflects the 'potentially execute code' outcome, while the description's confirmed and most reliable impact is a crash of the main Boa process (denial of service); full confidentiality/integrity compromise via code execution is stated as a possibility, not a demonstrated fact, so the H/H/H confidentiality and integrity ratings should be read as best-case-for-attacker rather than proven. Key risk-scoping data is MISSING: there is no EPSS score, no CISA KEV listing, and no explicit POC flag in the input, so widespread or active exploitation cannot be asserted. The product is a specific consumer router model (Netcore NR256CN), which constrains real-world blast radius compared to enterprise infrastructure despite the high CVSS. Net: prioritize patching/mitigation for any exposed NR256CN devices, but the absence of EPSS/KEV/POC signals means this reads as a serious latent risk rather than confirmed mass exploitation.

An unauthenticated attacker who can reach the router's web management interface sends an HTTP request to a protected /router/*.cgi endpoint with an HTTP Basic-auth username longer than 63 bytes. The user_ok() function copies the oversized username via strcpy() into a 64-byte stack buffer, corrupting the stack and crashing the Boa web server (loss of management availability), with the potential for arbitrary code execution if the overflow is weaponized. Given AV:N/AC:L/PR:N/UI:N, this requires only network reachability to the web interface and no credentials or user interaction; no public exploit is identified in the provided data.