CVE-2026-76071: Unauthenticated Pre-Auth Stack Buffer Overflow via sscanf %[^,] in skk_set.cgi ipFilterList Handler in Netis NC63

Researcher: Özcan Ersan (@ozcanpng)

Disclosure status

• CVE: CVE-2026-76071
• Vendor: Netis Systems Co., Ltd.
• Product: Netis NC63 AC1200 Wireless Dual Band Gigabit MU-MIMO Router
• Tested firmware: NC63_V3.0.0.3327
• Affected component: /bin/netis.cgi
• Endpoint: POST /cgi-bin/skk_set.cgi
• Trigger: ipFilterList=mod
• Dynamically confirmed parameter: destHost
• Same parser statically reached by: srcHost
• Authentication: none observed or required in the validated path
• Architecture: MIPS32r2 little-endian, o32 ABI, uClibc
• Vulnerability class: stack-based buffer overflow with saved return-address control
• Validation: original-hash production CGI in an isolated QEMU user-mode runtime
• CVE record state at preparation: assigned; CNA record details pending population

Executive summary

The generic MIB/value parser in Netis NC63 firmware V3.0.0.3327 parses the destHost field of ipFilterList with two %[^,] scansets but no maximum field widths. Each conversion writes to a 16-byte local stack buffer. A direct HTTP client can therefore submit a long comma-free component and overwrite the function's saved control data.

For the dynamically tested second destHost component, saved ra is exactly 112 bytes from the local buffer. QEMU tracing against the original-hash CGI confirmed an attacker-selected third entry at 0x0040f7f4. A separate observation-only test redirected the return to the original system() PLT path at 0x00423ab0 while preserving attacker-controlled request data as the exact MIPS a0 argument. A guarded /bin/sh logged the marker and executed no command.

The public PoC deliberately contains only an overlong B pattern. It does not include the private control-transfer value or command-boundary construction. The separately maintained RCE script in poc/exploit-db/ is prepared for an Exploit-DB submission and is intended for authorized testing of affected systems only.

Affected artifact integrity

193f6a5e2ce65972b1805bf076f8d3521379a8441c8aaeb5ad0ba174bbee0792  netis_NC63_V3.0.0.3327.bin
eb298774c27070dc595fefcabb4e8c12a46cb5f4fd08f91c3ca92282c3a289a2  squashfs-root/bin/netis.cgi
23faa747b7d2f067aa5431bcc227ceca97a7977cf3e7c372f715cbba57f9209b  squashfs-root/bin/boa
e3fd0ee3013014d59b14a409fb4ee5bb546e7d32413758ab3ad4fb0f0d3dcc47  squashfs-root/lib/libapmib.so

Attack surface and authentication status

The vendor frontend builds srcHost and destHost as three comma-separated components and posts them with ipFilterList to /cgi-bin/skk_set.cgi:

param.destHost = $("#dest_host").val();
param.destHost += "," + $("#dest_ip_1").val();
param.destHost += "," + $("#dest_ip_2").val();
param.ipFilterList = $("#ip_action").val();

request({
    url: "/cgi-bin/skk_set.cgi",
    data: param
});

The validated HTTP-shaped CGI request contained no Cookie or Authorization header. /tmp/boa_auth was absent, yet execution continued into the ipFilterList=mod and destHost parser path. The memory-corruption defect is the widthless scanset in FUN_0040f7f4; the broader CGI authorization failure is the condition that exposes this privileged handler pre-authentication.

Source-to-sink trace

Unauthenticated HTTP client
  |
  | POST /cgi-bin/skk_set.cgi
  | ipFilterList=mod
  | destHost=1,0.0.0.0,<long comma-free component>
  v
FUN_004138a0
  v
FUN_004134c8 (ipFilterList trigger row)
  v
FUN_00410898(request, "ipFilterList")
  v
FUN_0040f7f4(request, trigger, mib_table, pMib)
  |
  | get_request_param("destHost")
  v
sscanf(value, "%d,%[^,],%[^,]", ...)
  |
  | second destination: char[16]
  | no maximum scanset width
  v
saved fp overwrite -> saved ra overwrite -> controlled PC

The original libapmib.so metadata maps both srcHost and destHost to type 0x0c, which selects this parser case. Dynamic validation was performed with destHost; srcHost is included as static same-parser coverage rather than a separate dynamic claim.

Vulnerable code

Normalized Ghidra-derived pseudocode:

case 0x0c:
    value = get_request_param(request, metadata_name);
    sscanf(value,
           "%d,%[^,],%[^,]",
           &selector,
           first_ip_component,   /* char[16] */
           second_ip_component); /* char[16] */

    *(char *)(destination + field_offset) = selector;
    inet_aton(first_ip_component, destination + field_offset + 1);
    inet_aton(second_ip_component, destination + field_offset + 5);
    break;

sscanf() is not intrinsically the vulnerability. The defect is that %[^,] has no maximum field width, so sscanf has no knowledge that each destination is only 16 bytes. A capacity-aware format would use a width such as %15[^,], verify that exactly three conversions succeeded, and then validate the parsed address values. This is an example mitigation, not a vendor patch.

Stack corruption analysis

FUN_0040f7f4 begins at 0x0040f7f4 and creates a 0x1d0-byte frame:

0040f7f4  addiu sp,sp,-0x1d0
0040f7f8  sw    ra,0x1cc(sp)
0040f7fc  sw    fp,0x1c8(sp)
0040f800  sw    s0,0x1c4(sp)

The type-0x0c destinations are at fp+0x14c and fp+0x15c. Saved ra is at fp+0x1cc, making the exact distance from the second buffer:

0x1cc - 0x15c = 0x70 = 112 bytes

Dynamic verification

Program-counter control

The isolated PC proof used 112 padding bytes followed by the three low little-endian bytes of 0x0040f7f4; the sscanf terminator supplied the fourth zero byte. QEMU observed two ordinary parser entries followed by a third entry caused by the overwritten return address:

parser_entry_hit=3 pc=0x0040f7f4
GPR28: ... s8 41414141 ra 0040f7f4
total_parser_entry_hits=3
PASS: third parser entry is the overwritten saved RA.

Observation-only command boundary