EUVD-2026-38452
GHSA-jqc2-w244-p56p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible exploitation (AV:N) requires low-privilege authentication (PR:L); root-level command execution yields full C:H/I:H/A:H with no scope change beyond the device.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the username JSON parameter processed by the dalStorage_addUserAccount function. Attackers can exploit the unsafe concatenation of user-supplied input into a shell command string passed to rut_doSystemAction without sanitization to achieve full root-level command execution on the underlying operating system.
AnalysisAI
Authenticated remote code execution in NetComm NF20MESH routers running firmware R6B031 and earlier allows low-privileged authenticated attackers to gain full root-level OS control via OS command injection. The dalStorage_addUserAccount function unsafely concatenates attacker-supplied JSON username input into a shell command string executed by rut_doSystemAction without sanitization, enabling shell metacharacter injection. No public exploit identified at time of analysis and no CISA KEV listing, but a detailed public advisory from signal11.io documents the attack surface, and a vendor patch (implied R6B032) is available.
Technical ContextAI
CWE-78 (Improper Neutralization of Special Elements used in an OS Command) is the root cause: the router's firmware function dalStorage_addUserAccount accepts a username field from a JSON request and directly concatenates it into a shell command string passed to rut_doSystemAction for execution. No input sanitization or allowlist validation is applied before the string reaches the shell interpreter, making standard metacharacters (semicolons, backticks, pipes, subshell syntax) effective injection vectors. The affected product is identified by CPE cpe:2.3:a:netcomm_wireless_pty_ltd:nf20mesh, covering all firmware versions up to and including R6B031. The rut_doSystemAction execution context operates as root, meaning successful injection yields maximum OS privilege with no further escalation required.
RemediationAI
Upgrade affected NF20MESH devices to firmware R6B032 or later, available from the NetComm firmware portal at https://support.netcommwireless.com/products/nf20mesh#Firmware; release notes are documented at the vendor reference https://support.netcommwireless.com/api/Media/Firmware/4407c21d-e990-49a4-9754-b72475f20c76?Product=NF20MESH%20Release%20Notes.pdf. The fix version R6B032 is inferred from the VulnCheck advisory title and should be verified against the official firmware page before deployment. If immediate patching is not feasible, restrict access to the router management interface to trusted IP ranges only and disable remote WAN-side management entirely - this eliminates network-reachable exploitation paths with minimal operational impact. Additionally, audit all router credentials and rotate any that may have been exposed, since the PR:L requirement means credential compromise is the prerequisite for exploitation. Avoid exposing the management plane to untrusted networks in any configuration.
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today