CVE-2026-111710 is a high severity (CVSS 7.5) NULL pointer dereference in the Boa web server of the Netcore NR256CN router through firmware 1.5.140116. A malformed Authorization header from an unauthenticated user crashes the server and locks out management. The record names no fix.
What's affected
Netcore NR256CN through 1.5.140116, per the record and VulnCheck. The fault is in the user_auth() function of the Boa web server. I could not confirm a fixed release from the pages I fetched, so check the project's releases and issue tracker before you rely on one.
The record says a Basic Authorization value with no colon, for example one that decodes to a single character, sent to a protected route such as get_user_type.cgi kills the main Boa process. The impact is availability only.
Scoring note: the record's 7.5 is a CVSS 3.1 base score. VulnCheck's advisory also lists 8.7 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Check the firmware version in the router's status page. If it reads 1.5.140116 or older, treat it as affected.
Then check who can reach the management interface. A web server that crashes on bad input only matters to attackers who can reach it, so find out whether the management port is exposed to the internet or to guest networks.
What to do now
- List Netcore NR256CN devices and their firmware versions.
- Turn off remote management from the WAN side.
- Limit management access to a trusted wired segment.
- Check the vendor's support pages for newer firmware and apply it if present.
- Plan for restarting the device if the management interface stops responding.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Keep a record of what you checked and what you changed. Note the version found, the date, the action taken and who approved it. If the advisory is later updated, for example with a fixed release, you will know which systems need another pass, and an auditor or a colleague can follow your reasoning.
Why it matters
This is CWE-476, NULL pointer dereference. The authentication code splits the decoded credential at a colon and uses the result without checking that the split succeeded. When the colon is missing, the pointer is empty and the process dies.
The flaw is a reminder that parsing code on network facing firmware must handle malformed input before it does anything else. Crashing the management server also stops an admin from managing the router until it restarts. It is not listed in CISA KEV.
Quick check
Does this let an attacker control the router?
The record describes a crash and denial of management access, not code execution.
Who can trigger it?
Anyone who can reach the web interface, since no login is needed.
Sources
Last reviewed: 18 October 2026.
