Özcan Ersan

**Name of the Vulnerable Software and Affected Versions** Netis NC63 versions prior to V3.0.0.3327 **Description** A stack-based buffer overflow exists in the login handler of the '/bin/netis.cgi' endpoint. The issue occurs because the custom Base64 decoder fails to validate the output length against a fixed-size stack buffer when processing an oversized Base64-encoded password provided via the `password` parameter. Since the Boa web server executes the CGI environment with root privileges, an unauthenticated remote attacker can overwrite the saved stack state to achieve remote code execution as root. **Recommendations** Update Netis NC63 to a version newer than V3.0.0.3327. As a temporary mitigation, restrict access to the '/bin/netis.cgi' endpoint to trusted networks only.

**Name of the Vulnerable Software and Affected Versions** Netis NC63 versions prior to V3.0.0.3327 **Description** An issue exists where unauthenticated remote attackers can overwrite the saved stack state by providing an oversized `destHost` parameter to the `ipFilterList=mod` action in the 'netis.cgi' endpoint. This occurs because of widthless sscanf conversions that copy user-supplied input into fixed-size stack buffers before authentication is verified. Since the Boa web server executes the CGI environment with root privileges, this can lead to remote code execution as root. **Recommendations** Update Netis NC63 to a version newer than V3.0.0.3327. Avoid using the `destHost` parameter in the 'netis.cgi' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Netis NC63 version V3.0.0.3327 **Description** An authentication enforcement flaw in the Boa web server and `netis.cgi` CGI dispatcher allows unauthenticated attackers to upload unsigned firmware images. The Boa web server grants access to any path containing `.cgi` without requiring a valid session cookie, and the `netis.cgi` dispatcher fails to enforce the authentication state before triggering the firmware update handler. The system validates firmware images using static product strings and a forgeable additive checksum instead of a cryptographic signature, which could lead to persistent compromise of the router. This is exploited by sending a multipart POST request to the '/cgi-bin/upload fw.cgi' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.