Pre-Auth Stack Buffer Overflow in Netis NC63 Router (CVE-2026-76071) with POC

Vulnerability Overview CVE-2026-76071: Unauthenticated Pre-Authentication Stack Buffer Overflow via in 's Handler Researchers: Ozcan Ersan (@ozcanpang) Disclosure Status: - CVE: CVE-2026-76071 - Vendor: Netis Systems Co., Ltd. - Product: Netis NC63 AC1200 Wireless Dual Band Gigabit MU-MIMO Router - Tested Firmware: NC63_V3.0.0.3327 - Affected Component: - Endpoint: - Trigger: mode - Dynamic Confirmation Parameter: - Static Arrival via Same Parser: - Authentication: Not observed or required within the verification path - Architecture: MIPS32/2 little-endian, o32 ABI, uClibc - Vulnerability Class: Stack buffer overflow, controlled by unverified user input - Verification: Original hash production CGI in an isolated QEMU user-mode runtime - CVE Record Status: Assigned; CNA record details pending Impact Scope Affected Product: Netis NC63 AC1200 Wireless Dual Band Gigabit MU-MIMO Router Tested Firmware: NC63_V3.0.0.3327 Affected Component: Endpoint: Trigger: mode Dynamic Confirmation Parameter: Static Arrival via Same Parser: Authentication: Not observed or required within the verification path Architecture: MIPS32/2 little-endian, o32 ABI, uClibc Vulnerability Class: Stack buffer overflow, controlled by unverified user input Verification: Original hash production CGI in an isolated QEMU user-mode runtime Remediation Remediation Advice: Make the function size-aware by using width limits (e.g., ), verify that exactly three conversions succeed, and validate the parsed address values. This is a sample mitigation measure, not a vendor patch. POC Code Dynamic Verification Program Counter Control: Isolated PC proof indicates the use of 112 padding bytes, followed by three little-endian bytes . The terminator provided the fourth zero byte. QEMU observed two normal parser entries, followed by a third entry caused by the overwritten return address. Runtime Adaptation and Evidence Boundaries Runtime Adaptation: The tested is byte-identical to the production artifact. Since flash backup MIB state is unavailable in qemu-user, a one-time root adaptation was performed using the disclosed lab-only to allocate zero MIB state and adjust one packet field alignment. This does not alter the CGI request parser, the vulnerable , the stack frame, saved return offset, epilogue, or path. Static metadata was sourced from the original vendor . Evidence Boundaries: The original executable has a fixed base address, lacks a stack canary and RELRO, and features an executable stack with RWX segments. These characteristics support exploitability analysis but do not replace dynamic PC and protected boundary testing.

Goal Reached Thanks to every supporter — we hit 100%!

Pre-Auth Stack Buffer Overflow in Netis NC63 Router (CVE-2026-76071) with POC

More from this source