# CVE-2026-112016: Netcore NR256CN unauthenticated file write in Boa web server

Source: https://junglewise.ai/threats/cve-2026-112016-netcore-nr256cn-through-1-5-140116-contains-an-unauthenticated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-18  
License: CC BY 4.0 with a link back

CVE-2026-112016 · Severity: medium · CVSS 6.5 · Published 2026-10-18

Netcore NR256CN is a network router whose firmware contains a web server vulnerable to unauthenticated file writes. An attacker on the network can overwrite firmware update or configuration restore files without any authentication, allowing them to corrupt pending updates or cause the device to stop working.

Technologies: [Netcore NR256CN](https://junglewise.ai/threats/technologies/nr256cn). Vendors: [Netcore](https://junglewise.ai/threats/vendors/netcore).

## Quick answers

**Is CVE-2026-112016 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112016 being exploited in the wild.

**How severe is CVE-2026-112016?** Medium severity, with a CVSS score of 6.5, published 18 October 2026.

**Which products and versions are affected?** Netcore NR256CN through 1.5.140116.

**Is there a fix for CVE-2026-112016?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112016 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-112016?** Check whether you run Netcore NR256CN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Boa-derived web server in the NR256CN firmware accepts arbitrary .cgi pathnames without validation and routes POST bodies to fixed predictable temporary files (/tmp/boa_temp.update or /tmp/boa_temp.para) based on substring matching in the pathname. An unauthenticated remote attacker can send crafted HTTP POST requests to non-existent CGI endpoints to write attacker-controlled data into these staging files, enabling tampering with firmware updates, configuration restores, or denial of service.

## Affected products

- Netcore NR256CN through 1.5.140116

## Timeline

- 2026-10-16: disclosed
- 2026-10-18: advisory

## References

- [https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-fixed-tmp-sink-write.md](https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-fixed-tmp-sink-write.md)
- [https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-unauthenticated-write-to-fixed-boa-staging-files](https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-unauthenticated-write-to-fixed-boa-staging-files)

## Related threats

- [Netcore NR256CN authentication bypass via CGI path prefix](https://junglewise.ai/threats/cve-2026-111712-netcore-nr256cn-through-1-5-140116-contains-an-authentication)
- [Netcore NR256CN stack overflow in Boa web server user authentication](https://junglewise.ai/threats/cve-2026-111711-netcore-nr256cn-through-1-5-140116-contains-a-pre-authentication)
- [Netcore NR256CN NULL pointer dereference in Boa web server](https://junglewise.ai/threats/cve-2026-111710-netcore-nr256cn-through-1-5-140116-contains-a-null-pointer)