Description

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in netis.cgi. Attackers can exploit widthless sscanf conversions that copy user-supplied input into fixed-size stack buffers before authentication is verified, achieving remote code execution as root due to the Boa web server executing the CGI environment with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-24T16:17:23.117Z",
  "pubdate": "2026-08-24T16:17:23.117Z",
  "executiveSummary": "Netis NC63 firmware through V3.0.0.3327 is affected by a critical stack-based buffer overflow vulnerability residing in the netis.cgi binary.\nThe vulnerability allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action.\nDue to widthless sscanf conversions copying user-supplied input into fixed-size stack buffers prior to authentication verification, exploitation leads to remote code execution.\nBecause the Boa web server executes the CGI environment with root privileges, successful exploitation grants the attacker full administrative control over the underlying operating system.\nThe risk implication is severe, exposing affected devices to complete compromise over network exposure without requiring prior authentication credentials.",
  "technicalDetails": "The root cause of the vulnerability is the unsafe handling of user-supplied input via widthless sscanf format specifiers within the CGI application logic.\nThe vulnerable component is identified as the netis.cgi binary executed by the Boa web server, specifically when processing the ipFilterList=mod action.\nAffected versions include Netis NC63 firmware through V3.0.0.3327.\nAttackers can leverage network exposure to interact with the web interface remotely without any authentication requirements.\nThe attack flow begins when an unauthenticated remote attacker sends an HTTP request containing a maliciously crafted, oversized destHost parameter to the netis.cgi endpoint.\nThe application processes the input using widthless sscanf conversions, copying the excessive data directly into a fixed-size stack buffer before authentication checks are performed.\nThis operation overflows the stack buffer, overwriting critical saved stack state data, including return addresses and frame pointers.\nBy carefully constructing the payload, an attacker can hijack the control flow of the execution context.\nPost-exploitation impact is catastrophic because the Boa web server executes the CGI environment with root privileges, allowing the injected payload to achieve remote code execution as root."
}