CVE-2026-112016
Received Received - Intake

Unauthenticated File Write in Netcore NR256CN Router

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulnCheck

Description
Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into /tmp/boa_temp.update or /tmp/boa_temp.para, tampering with pending firmware updates or configuration restores or causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-112016
EUVD
EUVD-2026-103469

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Netcore NR256CN 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112016 is an unauthenticated file write vulnerability in Netcore NR256CN routers through version 1.5.140116. It exists in the Boa-derived web server (/bin/boa) and allows remote attackers to overwrite critical staging files by sending a POST request to a non-existent .cgi path. Attackers can write attacker-controlled content into /tmp/boa_temp.update or /tmp/boa_temp.para, which are used for firmware updates or configuration restores.

Detection Guidance

Check for unexpected POST requests to non-existent .cgi paths on the Netcore NR256CN router's web interface. Monitor /tmp/boa_temp.update and /tmp/boa_temp.para files for unauthorized modifications or unexpected content. Use network traffic analysis tools to detect anomalous HTTP POST requests targeting the Boa web server.

Impact Analysis

This vulnerability can allow attackers to tamper with pending firmware updates or configuration restores, potentially installing malicious firmware or altering device settings. It may also cause denial-of-service conditions by corrupting critical files. Since no authentication is required, any remote attacker can exploit this if the device is exposed to the internet.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized file tampering and denial of service. Unauthenticated attackers can overwrite critical files like firmware updates or configuration restores, potentially violating data integrity and availability requirements under these regulations.

Mitigation Strategies

Immediately update the Netcore NR256CN firmware to the latest patched version. Disable remote access to the router's web interface if not required. Implement network segmentation to isolate the router from critical systems. Monitor for signs of exploitation such as unexpected file changes in /tmp directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112016. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart