Netcore NR256CN devices running firmware versions up to 1.5.140116 suffer a pre‑authentication stack overflow in the Boa web server function Boa user_ok(). The function copies unvalidated Basic‑authentication usernames into a fixed 64‑byte stack buffer using an unbounded strcpy(). An unauthenticated attacker can include a username longer than 63 characters in an HTTP Basic‑Auth header sent to any /router/*.cgi route. The overflow can corrupt the call stack, causing the Boa process to crash or, at a minimum, destabilize the device. The vulnerability is unique in that it does not require authentication and can be triggered with a simple HTTP request, giving an attacker a broad attack surface in a managed network environment.

Devices from Netcore with the NR256CN product line, specifically firmware versions up to and including 1.5.140116. All revisions before 1.5.140117 are affected.

The CVSS score of 9.3 places this issue in the critical severity range. EPSS is not available, but the absence of a KEV listing does not reduce the risk; a stack‑overflow that can be triggered without authentication remains highly dangerous. Likely exploitation involves sending a Basic‑Auth header with an overly long username to the /router/*.cgi endpoints, which may be repeated until the Boa process is crashed or control is transferred. Exploitation requires no special privileges or authentication, making it readily actionable by anyone who can reach the web interface.