CVE-2026-76070

The Netis NC63 router firmware through version V3.0.0.3327 contains a stack-based buffer overflow (CWE-121) in the login handler of /bin/netis.cgi. An unauthenticated remote attacker triggers the flaw by submitting an oversized Base64-encoded password during login; the device's custom Base64 decoder does not validate output length before writing into a fixed-size stack buffer, overwriting saved stack state. Because the Boa web server runs the CGI environment as root, successful exploitation yields remote code execution with full root privileges on the device. Anyone operating a Netis NC63 with firmware V3.0.0.3327 or older whose web management interface is reachable is affected. A public proof-of-concept exists on GitHub, but there is no confirmed in-the-wild exploitation and the CVE is not in the CISA KEV catalog; EPSS estimates roughly a 1% chance of exploitation in the next 30 days.

What to do: Immediately check the firmware version on any Netis NC63 unit and treat anything at or below V3.0.0.3327 as vulnerable; upgrade to a firmware release newer than V3.0.0.3327 as soon as the vendor publishes one. Until a patch is applied, block all unsolicited WAN access to the router's web management interface (port forwarding, remote management, UPnP-exposed CGI endpoints) and manage the device only from the trusted LAN. Because exploitation is pre-auth and grants root, review logs and device behavior for signs of compromise before assuming a patched unit is clean.