Authentication Bypass Vulnerability in Netcore NR256CN by Netcore
CVE-2026-111712

6.9MEDIUM

Key Information:

Vendor

Netcore

Status
Nr256cn
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111712?

The Netcore NR256CN device, through version 1.5.140116, is exposed to an authentication bypass vulnerability. This flaw allows unauthorized users to access restricted management CGI handlers by manipulating the URI to include a public route prefix. By applying prefixes like 'l7_web_auth.cgi' or an '.ico' extension, attackers can bypass standard authentication checks and gain unauthorized access to protected management functions.

Affected Version(s)

NR256CN 0 <= 1.5.140116

References

https://github.com/lukadqq/netcore-router-public-refs/blo...
third-party-advisory
https://www.vulncheck.com/advisories/netcore-nr256cn-thro...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhou Ao
Yin Luxing
Lu Fangzhou
Liu Xin
.