Published: October 16, 2026 | Last Modified: October 16, 2026
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management handlers without credentials.
This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.