CVE-2026-76071 Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter
Unauthenticated remote attackers can achieve root code execution on Netis NC63 routers via a stack buffer overflow in the netis.cgi script.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76071?
CVE-2026-76071 is a critical memory corruption vulnerability in Netis Systems NC63, published on 24 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in netis.cgi. Attackers can exploit widthless sscanf conversions that copy user-supplied input into fixed-size stack buffers before authentication is verified, achieving remote code execution as root due to the Boa web server executing the CGI environment with root privileges.
Weakness: CWE-121
Which versions are affected by CVE-2026-76071?
How do I fix CVE-2026-76071?
No fix has been published for CVE-2026-76071 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-76071 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-76071 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-mx2q-89wp-jrvh.