The vulnerability allows an attacker to bypass authentication and write arbitrary content to predetermined staging files in the Boa-derived web server by issuing an HTTP POST request to a non‑existent .cgi path. The attacker can overwrite /tmp/boa_temp.update or /tmp/boa_temp.para, which are used for firmware updates or configuration restores. By corrupting these files, an attacker can tamper with pending firmware updates, inject malicious configurations, or cause a denial of service by disrupting normal update or restore workflows.

The flaw exists in Netcore routers running NR256CN firmware through version 1.5.140116. Any device that uses the embedded Boa web server with these firmware versions is susceptible. No other product or version information is documented in the supplied data.

With a CVSS score of 6.9, the vulnerability presents medium severity. The EPSS score is not available, and the risk is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending an unauthenticated HTTP POST request to a crafted .cgi path, a path that does not exist on the device. Successful exploitation requires network access to the web interface and no authentication credentials, making it straightforward for remote attackers to impact the device.