Executive brief
The Netis NC63 wireless router's web login interface contains a critical flaw in how it processes passwords. An attacker can send a specially crafted login request without knowing the correct password, causing the router's web server to crash or execute arbitrary commands with root privileges. This allows complete compromise of the device and any networks it protects.
Technical details
The vulnerability is a stack-based buffer overflow in the /bin/netis.cgi login handler on the Netis NC63 router. When processing the login POST request to /cgi-bin/login.cgi, the custom Base64 decoder function (FUN_00402bd4) writes decoded output to a 64-byte stack buffer without validating the decoded length or receiving a capacity parameter. An attacker can submit an oversized Base64-encoded payload that, when decoded, exceeds the buffer boundary and overwrites the saved frame pointer (at offset 132 bytes) and return address (at offset 136 bytes), achieving controlled program counter execution. The vulnerability is pre-authentication—the decoder runs before password comparison, meaning no credentials are required. The Boa web server executes CGI with root privileges, allowing remote code execution. Testing confirmed saved return-address control and attacker-influenced command execution.
Affected products
- Netis Systems Co., Ltd. NC63 through V3.0.0.3327
Timeline
- 2026-08-24: disclosed