CVE-2026-76071
Received Received - Intake

Stack-Based Buffer Overflow in Netis NC63 Firmware

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in netis.cgi. Attackers can exploit widthless sscanf conversions that copy user-supplied input into fixed-size stack buffers before authentication is verified, achieving remote code execution as root due to the Boa web server executing the CGI environment with root privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-76071
EUVD
EUVD-2026-64922

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
netis nc63 to 3.0.0.3327 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76071 is a stack-based buffer overflow in Netis NC63 firmware up to V3.0.0.3327. It occurs when the destHost parameter in the ipFilterList=mod action of netis.cgi receives oversized input. The vulnerability stems from unsafe sscanf usage that copies user input into fixed-size stack buffers without bounds checking, allowing unauthenticated remote attackers to overwrite stack state and execute arbitrary code with root privileges.

Detection Guidance

To detect this vulnerability, scan for devices running Netis NC63 firmware versions up to V3.0.0.3327. Check for open ports 80 or 443 and send a crafted POST request to /cgi-bin/skk_set.cgi with ipFilterList=mod and a long destHost parameter. Monitor for crashes or unexpected behavior in the Boa web server process.

Impact Analysis

This vulnerability allows attackers to gain full control of the Netis NC63 router remotely without authentication. They can execute arbitrary commands as root, manipulate router configurations, steal credentials, intercept network traffic, or disrupt services. The impact includes complete device compromise, potential network breaches, and loss of confidentiality and integrity of all router-managed communications.

Compliance Impact

This vulnerability allows unauthenticated remote attackers to execute arbitrary code with root privileges on the device. Such unauthorized access could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Immediately update Netis NC63 firmware to the latest version beyond V3.0.0.3327. If no patch is available, disable remote management access to the router, block external access to /cgi-bin/skk_set.cgi, and restrict network access to trusted devices only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76071. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart