by Kastro
Paper/Archive/CVE-2026-35019

CVE-2026-35019

NetComm Wireless Pty Ltd NF20MESH — NetComm NF20MESH < R6B032 Hardcoded AES Key Authentication Bypass

EPSS 0.8%CVSS 9.2
critical.is priorityof 100
39
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 56.8.568 × 2011.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded AES-256 key used to encrypt session cookies for the web management interface. Attackers can forge a valid encrypted session cookie using the shared hardcoded key and bypass authentication checks to obtain full administrative control of the management interface while any legitimate administrator session is active.

Affected

ProductAffectedFixed inSource
NF20MESH< R6B032R6B032CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupsignal11.io/advisories/netcomm-nf20-mesh-authentication-bypasspatchsupport.netcommwireless.com/api/Media/Firmware/4407c21d-e990-49a4-9754-b72475f20c76?Product=NF20MESH%20Release%20Notes.pdfrefsupport.netcommwireless.com/products/nf20mesh#Firmwarewriteupvulncheck.com/advisories/netcomm-nf20mesh-r6b032-hardcoded-aes-key-authentication-bypass