CVE-2026-111710: fallo de gravedad alta en Netcore NR256CN
Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.3%
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
Netcore · NR256CNCVEs relacionadas — Netcore NR256CN
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-111711CRITICALNetcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()EPSS 0.5%CVE-2026-112016MEDIUMNetcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging FilesEPSS 0.3%CVE-2026-111712MEDIUMNetcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path PrefixEPSS 0.2%