CVE-2026-111712: Netcore NR256CN

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.

Affected products

• Netcore NR256CN: up to and including 1.5.140116

Published 2026-10-16. Last modified 2026-10-16.