Summary
CVE-2026-76070 is a critical, pre-authentication stack-based buffer overflow in Netis NC63 wireless router firmware through version 3.0.0.3327. The flaw resides in the login handler of the netis.cgi binary, where an unsafe custom Base64 decoder fails to validate output length, allowing unauthenticated remote attackers to overwrite the stack and achieve remote code execution with root privileges. The vulnerability carries a severity score of 9.3–9.8 (Critical) and requires no authentication or user interaction to exploit.
Technical details
- Root cause: The device’s login handler decodes a Base64-encoded password using a custom decoder (
FUN_00402bd4) that does not validate the size of its decoded output before writing it into a fixed 64-byte stack buffer. - Trigger conditions: An attacker submits an oversized Base64-encoded value in the password parameter to the login endpoint; the decode operation occurs before any comparison against the configured administrator password, so no valid credentials are needed.
- Attack vector: Network-based, unauthenticated POST request to the CGI login endpoint (
/cgi-bin/login.cgi, dispatched via/bin/netis.cgi) served by the Boa web server. - Impact: A sufficiently long decoded payload (roughly 136+ bytes) overwrites the saved return address on the stack, giving the attacker control of program execution. Because the Boa web server runs CGI processes as root, successful exploitation yields remote code execution with full root privileges. The binary lacks stack canaries, RELRO, PIE, and NX protections, which removes common barriers to exploitation.
Affected software
- Netis NC63 Wireless AC1200 Router — firmware versions through NC63_V3.0.0.3327
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: No official vendor patch has been confirmed as available. Check the Netis support site for firmware updates addressing this issue and apply them as soon as they are released.
- If no patch is available:
- Remove the router’s administration/login interface from direct internet exposure; restrict access to trusted internal networks or a management VPN only.
- Place the device behind a firewall or reverse proxy that blocks or rate-limits requests to the CGI login endpoint.
- Monitor for anomalous POST requests or crashes/restarts of the device’s web management service, which may indicate exploitation attempts.
- Where feasible, replace or isolate affected NC63 units until a vendor fix is confirmed, given the device’s lack of standard binary exploit mitigations.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Named response header (
Server):netis - Page title:
Shock&Innovation!! netis setup,netis ... Router,netis 광대역 라우터 관리 패널