Netis NC63 EUVD-2026-64922

Exploitation requires network reachability to the NC63 web management interface and a single HTTP request to netis.cgi invoking the ipFilterList=mod action with an oversized destHost parameter; per CVSS PR:N/UI:N the overflow is triggered before authentication is verified, so no credentials or user interaction are needed against affected firmware (≤ V3.0.0.3327). The primary factor LIMITING exploitation is exposure of the web admin interface: if remote (WAN) management is disabled - the typical default on consumer routers - an external attacker cannot reach netis.cgi and exploitation is confined to adjacent/LAN attackers. Additional limits: the target must run vulnerable firmware V3.0.0.3327 or earlier, and reliable RCE (versus a crash/DoS) depends on the attacker defeating any device-specific stack protections and building a working payload for the NC63's architecture.

All available signals point to genuinely high, not inflated, risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA all High) describes a network-reachable, low-complexity, pre-authentication overflow with full confidentiality/integrity/availability impact on the device - the worst-case profile for an internet-facing router. This is reinforced by a publicly available proof-of-concept (VulnCheck advisory plus an independent write-up and GitHub PoC) and the root execution context. Counterbalancing factors: no EPSS score was provided, and the vulnerability is NOT on the CISA KEV list, so there is no confirmation of in-the-wild exploitation - the risk is high potential rather than proven mass exploitation. SSVC-style read: exploitation is 'PoC' (not 'active'), technical impact is 'total', and automatability is plausible (unauthenticated network reachable), which would drive an 'Attend'/'Act' style prioritization for exposed devices. Net: treat as a real, actionable priority for any exposed NC63, while noting active-exploitation and EPSS data are missing.

An attacker who can reach the NC63 web interface (e.g., a device with remote management exposed to the internet, or an attacker on the local network) sends a single crafted HTTP request to netis.cgi with ipFilterList=mod and an oversized destHost value. The widthless sscanf copy overflows a fixed-size stack buffer, overwriting the saved return address to hijack control flow and run attacker-supplied shellcode as root - no credentials or user interaction needed. A public proof-of-concept and write-up already exist, lowering the barrier to weaponization.