Skip to main content

Netis NC63 EUVDEUVD-2026-64922

| CVE-2026-76071 CRITICAL
Stack-based Buffer Overflow (CWE-121)
2026-08-24 VulnCheck GHSA-mx2q-89wp-jrvh
Stack Overflow Buffer Overflow RCE Nc63
9.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.8 CRITICAL

Unauthenticated, network-reachable, low-complexity pre-auth stack overflow yielding root code execution, so AV:N/AC:L/PR:N/UI:N with full C/I/A; scope unchanged as impact stays within the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 24, 2026 - 16:20 vuln.today
CVE Published
Aug 24, 2026 - 15:42 cve.org
CRITICAL 9.3

DescriptionCVE.org

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in netis.cgi. Attackers can exploit widthless sscanf conversions that copy user-supplied input into fixed-size stack buffers before authentication is verified, achieving remote code execution as root due to the Boa web server executing the CGI environment with root privileges.

AnalysisAI

Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized destHost parameter to the ipFilterList=mod action in netis.cgi, triggering a stack-based buffer overflow. Because the Boa web server runs CGI handlers as root and the overflow occurs before authentication is checked, successful exploitation yields full device takeover. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach NC63 web interface
Delivery
Send crafted netis.cgi ipFilterList=mod request
Exploit
Oversized destHost overflows stack buffer via sscanf
Execution
Overwrite saved return address
Persist
Execute shellcode as root
Impact
Full device compromise
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network reachability to the NC63 web management interface and a single HTTP request to netis.cgi invoking the ipFilterList=mod action with an oversized destHost parameter; per CVSS PR:N/UI:N the overflow is triggered before authentication is verified, so no credentials or user interaction are needed against affected firmware (≤ V3.0.0.3327). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment All available signals point to genuinely high, not inflated, risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach the NC63 web interface (e.g., a device with remote management exposed to the internet, or an attacker on the local network) sends a single crafted HTTP request to netis.cgi with ipFilterList=mod and an oversized destHost value. The widthless sscanf copy overflows a fixed-size stack buffer, overwriting the saved return address to hijack control flow and run attacker-supplied shellcode as root - no credentials or user interaction needed. …
Remediation No vendor-released patch version is identified in the available data, so at time of analysis no fixed firmware build can be cited - monitor the Netis product/support pages (https://www.netis-systems.com/products/NC63.html) and the VulnCheck advisory (https://www.vulncheck.com/advisories/netis-nc63-stack-buffer-overflow-via-desthost-parameter) for an updated release and apply it as the primary fix once available. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all Netis NC63 routers in production environments, document firmware versions and network locations, and assess which routers support internet-facing access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nc63

View all
CVE-2026-76070 CRITICAL POC
9.3 Aug 24

Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root b

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Stack Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Share

EUVD-2026-64922 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy