EUVD-2026-64921
GHSA-7gc7-3gxp-v85m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed NC63 web interface
-
DeliverySend login request with oversized Base64 password
-
ExploitOverflow fixed stack buffer in netis.cgi
-
ExecutionOverwrite saved return address
-
PersistExecute shellcode as root under Boa
-
ImpactFull device takeover
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the NC63 web management interface and the ability to reach the login handler at /bin/netis.cgi - the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication and no user interaction. The specific trigger is submitting an oversized Base64-encoded value in the login password parameter so that decoded output exceeds the fixed-size stack buffer. The main limiting factor is exposure: the device's HTTP admin interface must be reachable by the attacker, so units where web management is confined to the LAN or a trusted VLAN (and not exposed to the WAN/internet) are not remotely exploitable by an external attacker. Affected firmware is NC63 up to and including V3.0.0.3327. |
| Impact | This is a genuine top-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA all High) describes network-reachable, unauthenticated, low-complexity exploitation with total impact, and the presence of public exploit code sharply lowers the barrier to real-world abuse. The two independent signals - a fixed-size-buffer overflow with no length check, and CGI execution as root under Boa - reinforce each other, so a successful overflow means full compromise, not just a crash. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so probabilistic/exploitation-in-the-wild signals cannot be quantified here; the assessment rests on the CVSS vector plus confirmed public POC availability. Anyone operating these devices - even a small-to-mid-sized IT team responsible for a handful of branch routers - should treat internet-exposed NC63 management interfaces as an urgent, patch-or-isolate priority. |
| Exploit ScenarioDerived | An attacker scans for internet-exposed Netis NC63 login pages and sends a single crafted HTTP login request whose password field is an over-long Base64 string; the custom decoder overflows the fixed stack buffer in /bin/netis.cgi, overwrites the saved return address, and executes attacker-supplied shellcode as root under the Boa web server. Public exploit code (ozcanpng's GitHub repo and write-up) means this requires little custom development, and no authentication or user interaction is needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized Base64-encoded password to the login handler in /bin/netis.cgi, whose custom Base64 decoder writes past a fixed-size stack buffer. Because the Boa web server runs CGI processes as root, successful exploitation yields full device takeover. Publicly available exploit code exists (published by VulnCheck and researcher ozcanpng), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as being used in active attacks.
RemediationAI
No vendor-released patch is identified at time of analysis, and no fixed firmware version is present in the input, so upgrade to a corrected build cannot be specified yet - monitor https://www.netis-systems.com/products/NC63.html and the VulnCheck advisory (https://www.vulncheck.com/advisories/netis-nc63-stack-buffer-overflow-via-login-password-parameter) for a firmware release above V3.0.0.3327. Until a fix ships, the highest-value compensating control is to remove the device's web management interface from any untrusted or internet-facing network: block inbound access to the HTTP/HTTPS admin port at the perimeter and disable remote/WAN-side management so /bin/netis.cgi is unreachable from outside, accepting the trade-off that administration then requires LAN or VPN access. Restrict management to a dedicated admin VLAN or trusted source IPs to shrink the attack surface, and where the device's role permits, consider replacing it, since an unauthenticated pre-login root RCE cannot be mitigated by credential hygiene.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is /bin/netis.cgi, a CGI binary served by the Boa embedded web server that is common on low-cost networking appliances; Boa spawns CGI handlers in a process running with root privileges, so any memory-corruption bug in the CGI directly translates to root code execution. The root cause is CWE-121 (stack-based buffer overflow): the login handler passes an attacker-controlled password through a bespoke Base64 decoder that does not validate decoded output length against the destination stack buffer's fixed size. A Base64 string decodes to roughly 3/4 of its encoded length, so an over-long encoded password produces more decoded bytes than the buffer holds, overwriting adjacent saved stack state (including the saved return address) and enabling control-flow hijack. The CPE cpe:2.3:a:netis_systems:nc63 identifies the single affected product line.
Know when Nc63 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated, network-reachable, low-complexity overflow of the pre-login CGI (AV:N/AC:L/PR:N/UI:N) yielding root code execution, so C/I/A all High; scope unchanged as impact stays within the device.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi. Attackers can exploit the custom Base64 decoder's lack of output length validation against the fixed-size stack buffer to achieve remote code execution with root privileges, as the Boa web server executes the CGI environment as root.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A critical vulnerability in Netis NC63 routers enables unauthenticated remote code execution and complete device takeover, immediately exposing any organization operating this equipment to network compromise and unauthorized infrastructure access. Organizations face operational disruption and data interception risk across connected networks. The combination of publicly available exploit code and absence of security patches creates an urgent remediation imperative with no time for gradual rollouts.
No vendor-released patch identified at time of analysis. Implement the following interim mitigations: (1) Block all external network access to device management interfaces via firewall rules; (2) Restrict local web interface access to designated administrative subnets only; (3) Implement network-level monitoring and alerting for suspicious POST requests to /bin/netis.cgi; (4) Disable remote management features if operationally feasible; (5) Maintain contingency inventory for rapid hardware substitution and establish weekly monitoring of Netis security advisories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB