CVE-2026-111712 Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix
Unauthenticated attackers can bypass authentication on Netcore NR256CN routers by prefixing URIs with public routes to access protected management handlers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111712?
CVE-2026-111712 is a medium-severity authentication bypass vulnerability in Netcore NR256CN, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.
Weakness: CWE-288
Which versions are affected by CVE-2026-111712?
How do I fix CVE-2026-111712?
No fix has been published for CVE-2026-111712 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-111712 being exploited?
There is no known exploitation of CVE-2026-111712 in the wild and no public exploit code.
Sources
Also known as GHSA-5r7c-rr63-2rwm.