CVE-2026-111710
Received Received - Intake

NULL Pointer Dereference in Netcore NR256CN Boa Web Server

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111710
EUVD
EUVD-2026-103002

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Netcore NR256CN 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Netcore NR256CN through version 1.5.140116 has a NULL pointer dereference flaw in the Boa web server's user_auth() function. Unauthenticated attackers can exploit this by sending a malformed Authorization header, such as a Basic Authorization value without a colon, to crash the server. This causes the main Boa process to terminate, denying access to the management interface.

Detection Guidance

To detect this vulnerability, monitor for crashes in the Boa web server process when malformed Authorization headers are sent. Use network scanning tools like curl to send test requests with invalid Basic Authorization headers to protected routes such as /router/get_user_type.cgi. Check server logs for NULL pointer dereference errors or unexpected termination of the Boa process.

Impact Analysis

This vulnerability allows attackers to crash the Netcore NR256CN device's web server remotely without authentication. The impact includes denial of service, making the device's management interface inaccessible. Users may lose control over the device until it is manually restarted.

Mitigation Strategies

Immediately update the Netcore NR256CN device to the latest firmware version that fixes this issue. If an update is not available, restrict access to the Boa web server by disabling remote management interfaces or blocking external traffic to ports used by the server. Implement network segmentation to isolate the device from critical systems until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111710. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart