# CVE-2026-111712: Netcore NR256CN authentication bypass via CGI path prefix

Source: https://junglewise.ai/threats/cve-2026-111712-netcore-nr256cn-through-1-5-140116-contains-an-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111712 · Severity: medium · CVSS 6.5 · Published 2026-10-16

The Netcore NR256CN is a router that manages network access and administration. An authentication bypass vulnerability allows unauthenticated attackers to gain access to protected management interfaces by using specific URI prefixes, potentially enabling them to take over the router's configuration and settings.

Technologies: [Netcore NR256CN](https://junglewise.ai/threats/technologies/nr256cn). Vendors: [Netcore](https://junglewise.ai/threats/vendors/netcore).

## Quick answers

**Is CVE-2026-111712 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111712 being exploited in the wild.

**How severe is CVE-2026-111712?** Medium severity, with a CVSS score of 6.5, published 16 October 2026.

**Which products and versions are affected?** Netcore NR256CN through 1.5.140116.

**Is there a fix for CVE-2026-111712?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111712 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-111712?** Check whether you run Netcore NR256CN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The NR256CN router fails to properly enforce authentication for management CGI handlers, allowing attackers to bypass login by prefixing requests with public routes (l7_web_auth.cgi or .ico paths). This CWE-288 (Authentication Bypass Using an Alternate Path or Channel) vulnerability requires only network access and no user interaction. Attackers gain unauthenticated access to protected management functionality.

## Affected products

- Netcore NR256CN through 1.5.140116

## Timeline

- 2026-10-16: disclosed: CVE-2026-111712 published

## References

- [https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-cgi-auth-bypass-alternate-path.md](https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-cgi-auth-bypass-alternate-path.md)
- [https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-authentication-bypass-via-cgi-path-prefix](https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-authentication-bypass-via-cgi-path-prefix)

## Related threats

- [Netcore NR256CN unauthenticated file write in Boa web server](https://junglewise.ai/threats/cve-2026-112016-netcore-nr256cn-through-1-5-140116-contains-an-unauthenticated)
- [Netcore NR256CN stack overflow in Boa web server user authentication](https://junglewise.ai/threats/cve-2026-111711-netcore-nr256cn-through-1-5-140116-contains-a-pre-authentication)
- [Netcore NR256CN NULL pointer dereference in Boa web server](https://junglewise.ai/threats/cve-2026-111710-netcore-nr256cn-through-1-5-140116-contains-a-null-pointer)