CVE-2026-76071

Netis NC63 routers running firmware through V3.0.0.3327 contain a stack-based buffer overflow in the netis.cgi web interface that can be triggered by an unauthenticated remote attacker. The flaw arises because a widthless sscanf conversion copies an attacker-supplied, oversized destHost parameter — sent to the ipFilterList=mod action — into a fixed-size stack buffer, overwriting saved stack state before any authentication check occurs. Because the Boa web server executes the CGI environment with root privileges, successful exploitation yields remote code execution as root, giving the attacker full control of the router (CVSS 4.0: 9.3, critical). All NC63 units on firmware V3.0.0.3327 and earlier are affected. A public proof-of-concept exists on GitHub, but EPSS is low (1.1%, 63rd percentile), the CVE is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported to date.

What to do: Check whether any Netis NC63 units exist on your network or remote-worker sites and verify the firmware version against V3.0.0.3327; contact Netis for a firmware release newer than V3.0.0.3327, or retire/replace devices that cannot be patched. Ensure the router's web interface (netis.cgi/Boa) is never reachable from the internet — disable remote/WAN management and remove any port forwards to the device. Monitor device logs and upstream traffic for unauthenticated POSTs to netis.cgi with abnormally long destHost values in ipFilterList=mod requests, and reboot-and-audit any device suspected of compromise since root RCE leaves no reliable local audit trail.