NULL Pointer Dereference Vulnerability in Netcore NR256CN Boa Web Server

CVE-2026-111710

What is CVE-2026-111710?

The Netcore NR256CN device, specifically through version 1.5.140116, contains a vulnerability in the Boa web server's user_auth() function. An unauthenticated attacker can exploit this flaw by sending a malformed Authorization header, such as a Basic Authorization value that omits the requisite colon. This malformed input can lead to a crash of the Boa process, resulting in the denial of access to the management interface. The vulnerability highlights the importance of robust input validation and error handling in web server applications to prevent Denial of Service attacks.

References