Unauthenticated RCE in Netis NC63 /bin/netis.cgi Login Handler

This repository is a research and proof-of-concept package for CVE-2026-76070, an unauthenticated pre-authentication stack buffer overflow in the Netis NC63 router web management interface. The vulnerability exists in /bin/netis.cgi, specifically the login handler for POST /cgi-bin/login.cgi, where the attacker-controlled password parameter is Base64-decoded into a fixed 64-byte stack buffer without any destination-capacity check. The repository documents that the saved MIPS return address is 136 bytes from the start of the decoded buffer, enabling return-address overwrite and program-counter control. Repository structure is small and focused: README.md provides the full vulnerability narrative, exploitation conditions, stack layout, dynamic validation results, and remediation guidance; attachments/decompiled-functions/ contains normalized decompiled C and disassembly excerpts for the vulnerable login handler and custom Base64 decoder; attachments/production-boa-config.txt captures original firmware web-server configuration showing root execution context and CGI paths; evidence/ contains hashes and runtime traces proving crash, PC control, and a guarded observation-only system() boundary test; and poc/poc.py is the only executable exploit code. The PoC script is intentionally limited and safety-scoped. It builds a form-urlencoded POST body where password is Base64 for a repeated 'B' pattern, defaulting to 140 decoded bytes. In dry-run mode it only prints the request body and metadata. With --send and an explicit target URL, it sends a POST request to /cgi-bin/login.cgi using urllib. The script does not contain a return-oriented chain, shellcode, command payload, persistence, or callback logic. Its main exploit capability is demonstrating the overflow and likely crashing the CGI process, while the documentation separately establishes that a private withheld chain reached the binary's existing system() call with attacker-controlled argument, indicating an RCE primitive in the vulnerable code path. Overall, this is a legitimate exploit repository centered on a public-safe PoC plus strong reverse-engineering evidence. It targets a web/network attack surface, requires no authentication, and is best classified as a POC rather than weaponized exploit code because the public implementation stops at crash/PC-control demonstration.