Netis NC63 firmware — CVE-2026-76071 (Critical)

Date Aug 24, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Netis · NC63 firmware

CVE CVE-2026-76071

Critical vendor advisory CVE-2026-76071

Summary

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in netis.cgi. Attackers can exploit widthless sscanf conversions that copy user-supplied input into fixed-size stack buffers before authentication is verified, achieving remote code execution as root due to the Boa web server executing the CGI environment with root privileges.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Netis NC63 firmware. Patch or mitigate promptly.

Operator check

Review CVE-2026-76071 in your asset inventory. Apply patches per vendor guidance and verify NC63 firmware is not exposed. CVSS score: 9.8.

Sources

NVD — CVE-2026-76071 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed