CVE-2026-111711 Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()
Unauthenticated attackers can trigger a stack overflow in the Boa web server via long usernames, potentially executing code or crashing the router.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111711?
CVE-2026-111711 is a critical memory corruption vulnerability in Netcore NR256CN, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected /router/*.cgi route to crash the main Boa process or potentially execute code.
Weakness: CWE-121
Which versions are affected by CVE-2026-111711?
How do I fix CVE-2026-111711?
No fix has been published for CVE-2026-111711 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-111711 being exploited?
There is no known exploitation of CVE-2026-111711 in the wild and no public exploit code.
Sources
Also known as GHSA-5769-g37j-m8jq.