CVE-2026-76070

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi. Attackers can exploit the custom Base64 decoder's lack of output length validation against the fixed-size stack buffer to achieve remote code execution with root privileges, as the Boa web server executes the CGI environment as root.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ozcanpng/CVE-2026-76070
https://ozcanpng.dev/blog/cve-2026-76070-netis-nc63-login-stack-buffer-overflow/
https://www.netis-systems.com/products/NC63.html
https://www.vulncheck.com/advisories/netis-nc63-stack-buffer-overflow-via-login-password-parameter

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) El firmware de Netis NC63 hasta la versión V3.0.0.3327 contiene una vulnerabilidad de desbordamiento de búfer basado en pila que permite a atacantes remotos no autenticados sobrescribir el estado de pila guardado al enviar una contraseña codificada en Base64 de tamaño excesivo al gestor de inicio de sesión en /bin/netis.cgi. Los atacantes pueden explotar la falta de validación de la longitud de salida del decodificador Base64 personalizado contra el búfer de pila de tamaño fijo para lograr la ejecución remota de código con privilegios de root, ya que el servidor web Boa ejecuta el entorno CGI como root.

Information

Published : 2026-08-24 16:17

Updated : 2026-10-12 15:10

NVD link : CVE-2026-76070

Mitre link : CVE-2026-76070

CVE.ORG link : CVE-2026-76070

JSON object : View

Products Affected

No product.

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-76070", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76070", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T18:28:03.496296Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Netis Systems", "product": "NC63", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.0.0.3327"}], "defaultStatus": "affected"}]}], "published": "2026-08-24T16:17:22.963", "references": [{"url": "https://github.com/ozcanpng/CVE-2026-76070", "source": "disclosure@vulncheck.com"}, {"url": "https://ozcanpng.dev/blog/cve-2026-76070-netis-nc63-login-stack-buffer-overflow/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.netis-systems.com/products/NC63.html", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/netis-nc63-stack-buffer-overflow-via-login-password-parameter", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi. Attackers can exploit the custom Base64 decoder's lack of output length validation against the fixed-size stack buffer to achieve remote code execution with root privileges, as the Boa web server executes the CGI environment as root."}, {"lang": "es", "value": "El firmware de Netis NC63 hasta la versi\u00f3n V3.0.0.3327 contiene una vulnerabilidad de desbordamiento de b\u00fafer basado en pila que permite a atacantes remotos no autenticados sobrescribir el estado de pila guardado al enviar una contrase\u00f1a codificada en Base64 de tama\u00f1o excesivo al gestor de inicio de sesi\u00f3n en /bin/netis.cgi. Los atacantes pueden explotar la falta de validaci\u00f3n de la longitud de salida del decodificador Base64 personalizado contra el b\u00fafer de pila de tama\u00f1o fijo para lograr la ejecuci\u00f3n remota de c\u00f3digo con privilegios de root, ya que el servidor web Boa ejecuta el entorno CGI como root."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "disclosure@vulncheck.com"}