CVE-2026-111710
CVE-2026-111710 · Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a single character, to protected routes like /router/get_user_type.cgi to kill the main Boa process and deny management interface access.
CVSS 8.7 · Alta · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
nr256cn
- Versiones
- ≥ 0, ≤ 1.5.140116: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-basic-auth-null-deref.md
- https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-boa-web-server-null-pointer-dereference-dos
- https://nvd.nist.gov/vuln/detail/CVE-2026-111710