An unauthenticated remote code execution vulnerability in Netis NC63 firmware poses a critical risk to device integrity and network security.

This is a stack-based buffer overflow triggered by an oversized Base64-encoded password submitted to the login handler. Because the Boa web server executes the environment with root privileges, an unauthenticated attacker can execute arbitrary code with full system control.

Successful exploitation grants an attacker full root-level access to the affected router. This allows for total compromise of the device, enabling traffic interception, lateral movement into internal networks, and potential long-term persistence, which justifies its critical 9.8 CVSS score.

Immediate Action: Apply the latest firmware update provided by Netis Systems as soon as it becomes available. If no update is currently available, restrict management interface access to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for anomalous login attempts or unusual traffic patterns originating from the management interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network filter to inspect and block malformed Base64 payloads targeting the device login parameters.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Given the critical severity and the existence of public exploit code, users must prioritize securing these devices. If an official firmware patch is not yet installed, isolate the device from the public internet immediately to prevent unauthorized remote access.