Vulnerability · Published Aug 24, 2026 · Assigned by VulnCheck

CVE-2026-76071Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter

Critical 9.8

In plain English

A critical-severity stack buffer overflow in NC63 from Netis Systems. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.4%top 27.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in netis.cgi. Attackers can exploit widthless sscanf conversions that copy user-supplied input into fixed-size stack buffers before authentication is verified, achieving remote code execution as root due to the Boa web server executing the CGI environment with root privileges.

Affected products (as reported)

Vendor	Product	Versions
Netis Systems	NC63	0 – through 3.0.0.3327

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Researcher Blog technical-description, exploit
Researcher GitHub Repo technical-description, exploit
Product Page product
https://www.vulncheck.com/advisories/netis-nc63-stack-buffer-overflow-via-desthost-parameter third-party-advisory