# CVE-2026-111711: Netcore NR256CN stack overflow in Boa web server user authentication

Source: https://junglewise.ai/threats/cve-2026-111711-netcore-nr256cn-through-1-5-140116-contains-a-pre-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111711 · Severity: critical · CVSS 9.8 · Published 2026-10-16

The Netcore NR256CN is a wireless router's web management interface vulnerable to a pre-authentication stack overflow attack. An unauthenticated attacker can send a specially crafted login request to crash the router's web server or potentially run arbitrary code, causing a denial of service or full device compromise.

Technologies: [Netcore NR256CN](https://junglewise.ai/threats/technologies/nr256cn). Vendors: [Netcore](https://junglewise.ai/threats/vendors/netcore).

## Quick answers

**Is CVE-2026-111711 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111711 being exploited in the wild.

**How severe is CVE-2026-111711?** Critical severity, with a CVSS score of 9.8, published 16 October 2026.

**Which products and versions are affected?** Netcore NR256CN through 1.5.140116.

**Is there a fix for CVE-2026-111711?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111711 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-111711?** Check whether you run Netcore NR256CN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the Boa web server's user_ok() function when processing HTTP Basic authentication credentials. The vulnerability occurs because the function uses unbounded strcpy() to copy the decoded username into a 64-byte stack buffer without length validation; usernames exceeding 63 bytes overflow the buffer before authentication checks are performed. An unauthenticated remote attacker can exploit this via a single HTTP request to any protected /router/*.cgi route, corrupting the stack and crashing the web server or achieving arbitrary code execution.

## Affected products

- Netcore NR256CN through 1.5.140116

## Timeline

- 2026-10-16: disclosed

## References

- [https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-basic-auth-stack-overflow.md](https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-basic-auth-stack-overflow.md)
- [https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-pre-auth-stack-overflow-via-boa-user-ok](https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-pre-auth-stack-overflow-via-boa-user-ok)

## Related threats

- [Netcore NR256CN unauthenticated file write in Boa web server](https://junglewise.ai/threats/cve-2026-112016-netcore-nr256cn-through-1-5-140116-contains-an-unauthenticated)
- [Netcore NR256CN authentication bypass via CGI path prefix](https://junglewise.ai/threats/cve-2026-111712-netcore-nr256cn-through-1-5-140116-contains-an-authentication)
- [Netcore NR256CN NULL pointer dereference in Boa web server](https://junglewise.ai/threats/cve-2026-111710-netcore-nr256cn-through-1-5-140116-contains-a-null-pointer)