Description

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi. Attackers can exploit the custom Base64 decoder's lack of output length validation against the fixed-size stack buffer to achieve remote code execution with root privileges, as the Boa web server executes the CGI environment as root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-24T16:17:22.963Z",
  "pubdate": "2026-08-24T16:17:22.963Z",
  "executiveSummary": "Netis NC63 firmware through version V3.0.0.3327 suffers from a critical stack-based buffer overflow vulnerability residing within the login handler of the CGI binary. The flaw allows unauthenticated remote attackers to trigger memory corruption by supplying a maliciously crafted, oversized Base64-encoded password input.\nSuccessful exploitation of this vulnerability enables remote code execution with root privileges. This elevated impact stems from the execution context of the underlying Boa web server, which runs all CGI processes as the root user. The risk implications are severe, granting complete compromise of the affected routing device without requiring prior authentication or user interaction.\nAttackers can leverage network exposure to deliver the exploit payload directly to the login interface over HTTP. The requirement for exploitation relies solely on reaching the vulnerable web service with a payload that exceeds the bounds allocated for the target stack buffer during the Base64 decoding process.",
  "technicalDetails": "The vulnerability is localized to the /bin/netis.cgi binary executed by the Boa web server on Netis NC63 firmware versions up to and including V3.0.0.3327. The root cause of the flaw is an implementation deficiency within the custom Base64 decoding routine, which fails to perform adequate output length validation prior to writing decoded data into a fixed-size stack buffer.\nThe attack flow begins when an unauthenticated remote attacker sends an HTTP request containing an intentionally oversized Base64-encoded password string to the login handler endpoint managed by netis.cgi. Upon receipt, the application passes the parameter to the vulnerable decoding function. Because the custom decoder lacks boundary checks against the destination buffer, the excessive decoded byte stream overflows the allocated stack space.\nAs the execution continues, the overflow permits the attacker to overwrite critical saved stack state, including the saved frame pointer and return address. By carefully crafting the payload within the Base64 input, an adversary can hijack the control flow of the application when the function attempts to return.\nBecause the Boa web server spawns the CGI environment with root privileges, achieving control flow redirection via the overwritten stack state directly results in arbitrary remote code execution under the root security context. This grants the attacker full administrative control over the underlying operating system and device peripherals, enabling persistent compromise, reconfiguration, or pivoting within the local network."
}