Netcore NR256CN EUVD-2026-103469

Exploitation requires network reachability to the device's Boa-derived /bin/boa web server and the ability to send an HTTP POST to a non-existent .cgi pathname; no authentication, user interaction, or special configuration is needed (PR:N/UI:N). The practical LIMITING factors are: (1) impact is confined to two hardcoded staging files (/tmp/boa_temp.update, /tmp/boa_temp.para), so it does not grant arbitrary file write or direct RCE; (2) meaningful tampering is most impactful only when a firmware update or configuration restore is pending; and (3) the router's web interface must be reachable by the attacker, which on default deployments is typically LAN-side rather than WAN-exposed, reducing remote Internet exposure.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which aligns with the CWE-306 (Missing Authentication) classification and the description's 'unauthenticated file write' claim - these signals are internally consistent. However, the impact is deliberately bounded: VC:N/VI:L/VA:L indicates no confidentiality loss and only limited integrity/availability effects, because the attacker can only write to two fixed staging files (/tmp/boa_temp.update and /tmp/boa_temp.para) rather than achieve arbitrary file write or direct code execution. This yields the moderate 6.9 score. No EPSS score was supplied, the CVE is NOT in CISA KEV, and the two references are a VulnCheck advisory and a public write-up repository - not weaponized exploit code - so exploitation status is 'no public exploit identified at time of analysis.' Net assessment: this is a legitimate unauthenticated flaw worth patching on exposed devices, but it is NOT a high-priority mass-exploitation threat - the limited, staging-file-scoped impact and the niche consumer-router footprint keep real-world risk moderate rather than critical. KEY MISSING DATA: no EPSS probability and no confirmed vendor patch version were provided, so widespread-exploitation likelihood cannot be quantified.

A remote attacker who can reach the router's web management interface (e.g., an Internet-exposed or LAN-adjacent device) sends a crafted HTTP POST to a non-existent .cgi path on the Boa-derived /bin/boa server. The server writes the attacker-controlled body into /tmp/boa_temp.update or /tmp/boa_temp.para, corrupting a pending firmware update or configuration restore, or exhausting/tampering with staging state to cause denial of service. No public exploit code was identified, though the attack is trivial to reproduce given the low complexity and absence of authentication.