A critical stack-based buffer overflow in the Netis NC63 web interface lets unauthenticated remote attackers execute code as root through an oversized destHost parameter.
What Is It
CVE-2026-76071 is a stack-based buffer overflow (CWE-121) in Netis NC63 firmware. The flaw sits in netis.cgi, where the ipFilterList=mod action processes a user-supplied destHost parameter. According to the researcher's reverse engineering of the firmware binary, the CGI handler uses widthless sscanf conversions to copy that input into fixed-size stack buffers, allowing an attacker to overwrite saved stack state with an oversized value. This mechanism has not been independently confirmed by the vendor or a second analyst.
The same analysis reports that this parsing happens before authentication is verified, which would mean no credentials are required, and that the device's Boa web server runs the CGI environment with root privileges; making successful exploitation equivalent to remote code execution as root. Both details rest on that single write-up rather than on vendor documentation.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS 4.0 score of 9.3 (CRITICAL). Every exploitability factor is at its worst case: network-reachable, low attack complexity, no privileges, no user interaction, and full confidentiality, integrity, and availability impact.
An attacker who reaches the web interface gains complete control of the router; the network boundary device itself. CVE-2026-76071 does not appear in CISA's Known Exploited Vulnerabilities catalog as of this writing, so active exploitation is not confirmed; readers can verify current status directly against the catalog, which is updated on a rolling basis. Public proof-of-concept material is available via the researcher's GitHub repository and blog write-up.
What's Vulnerable
- Vendor: Netis Systems
- Product: NC63
- Affected versions: all firmware versions up to and including V3.0.0.3327
No CPE entries were assigned in the NVD record at time of publication.
Patch Status
The NVD record (published 2026-08-24, status Received) lists no vendor patch, fixed version, or mitigation guidance. No required remediation action has been specified. Until Netis publishes fixed firmware, operators should treat exposure of the NC63 web interface, particularly to untrusted or WAN-facing networks, as the primary risk to control.
Sources
- NVD, CVE-2026-76071: https://nvd.nist.gov/vuln/detail/CVE-2026-76071
- VulnCheck Advisory; Netis NC63 Stack Buffer Overflow via destHost Parameter: https://www.vulncheck.com/advisories/netis-nc63-stack-buffer-overflow-via-desthost-parameter
- Researcher Write-up (ozcanpng): https://ozcanpng.dev/blog/cve-2026-76071-netis-nc63-ipfilter-stack-buffer-overflow/
- Proof-of-Concept Repository: https://github.com/ozcanpng/CVE-2026-76071
- Netis Systems; NC63 Product Page: https://www.netis-systems.com/products/NC63.html
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog