CVE-2026-112016
CVE-2026-112016 · Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into /tmp/boa_temp.update or /tmp/boa_temp.para, tampering with pending firmware updates or configuration restores or causing denial of service.
CVSS 6.9 · Media · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
nr256cn
- Versiones
- ≥ 0, ≤ 1.5.140116: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-fixed-tmp-sink-write.md
- https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-unauthenticated-write-to-fixed-boa-staging-files
- https://nvd.nist.gov/vuln/detail/CVE-2026-112016