Netcore NR256CN vulnerabilities

3 CVEs affecting Netcore NR256CN, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-111712, published 2026-10-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-111711, published 2026-10-16. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy()…
CVE-2026-111710, published 2026-10-16. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a…
CVE-2026-111712, published 2026-10-16. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public…