Which versions of NetComm NF20MESH are affected by CVE-2026-35019?

The NetComm NF20MESH router platform contains a critical flaw that allows unauthorized individuals to seize administrative control of network infrastructure through cryptographic manipulation,…. A patch is available.

How to fix or mitigate CVE-2026-35019?

24 hours: Identify and inventory all NetComm NF20MESH routers running firmware R6B031 or earlier in your network environment. 7 days: Apply vendor-released patch to all identified affected devices, prioritizing those with internet-facing management interfaces. 30 days: Review access logs for suspicious administrative activity during the exposure period and confirm patch deployment success across all affected systems.

NetComm NF20MESH CVE-2026-35019

Q: What is the CVSS score of CVE-2026-35019?

CVE-2026-35019 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-38453 CRITICAL

Use of Hard-coded Cryptographic Key (CWE-321)

2026-06-23 VulnCheck

GHSA-pqh9-6ffr-v5fc

Authentication Bypass Nf20Mesh

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

AV:N for network-accessible management interface; AC:H reflects the specific prerequisite of an active admin session (maps to AT:P in CVSS 4.0); PR:N as attacker requires no credentials; full C/I/A impact on the router.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 15:04 vuln.today

DescriptionCVE.org

NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded AES-256 key used to encrypt session cookies for the web management interface. Attackers can forge a valid encrypted session cookie using the shared hardcoded key and bypass authentication checks to obtain full administrative control of the management interface while any legitimate administrator session is active.

AnalysisAI

Authentication bypass in NetComm NF20MESH routers (firmware R6B031 and earlier) allows unauthenticated remote attackers to forge valid encrypted session cookies using a hardcoded AES-256 key embedded in the firmware, granting full administrative control of the web management interface. The root cause is CWE-321 (Use of Hard-coded Cryptographic Key): because the same static AES-256 key is shared across all devices, any attacker who extracts it from firmware can impersonate any session. Exploitation requires an active administrator session and network reachability to the management interface; no KEV listing or confirmed public exploit exists at time of analysis, though the hardcoded-key nature makes the attack highly automatable once the key is disclosed.

Technical ContextAI

The NetComm NF20MESH is a residential and small-business mesh networking router manufactured by NetComm Wireless Pty Ltd (CPE: cpe:2.3:a:netcomm_wireless_pty_ltd:nf20mesh:*:*:*:*:*:*:*:*). Its web management interface authenticates sessions using AES-256 encrypted cookies. The vulnerability stems from CWE-321 (Use of Hard-coded Cryptographic Key): the AES-256 encryption key is baked into the firmware image rather than generated per-device or per-deployment. Because the key is identical across all NF20MESH units, an attacker who reverse-engineers one firmware image possesses the cryptographic material needed to forge cookies accepted by every unpatched device. This eliminates the secrecy assumption that makes symmetric encryption viable for session authentication. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) reflects network accessibility with no required privileges, but notes an attack prerequisite (AT:P) - specifically, that a legitimate administrator session must be active for the forged cookie to be honored by the management interface.

RemediationAI

The primary fix is upgrading to NetComm NF20MESH firmware R6B032 or later, available from the NetComm Wireless support portal at https://support.netcommwireless.com/products/nf20mesh#Firmware; the release notes confirming the fix are published at the vendor's firmware distribution endpoint. Until patching is complete, administrators should immediately restrict network access to the web management interface using firewall ACLs or router-level rules to allow only trusted management IP addresses - since the attack requires network reachability to the management interface (AV:N), blocking untrusted access eliminates the attack vector entirely with no functional trade-off for most deployments. Additionally, keeping administrator sessions as short as possible and logging out when done reduces the exploitation window, since the AT:P condition requires an active admin session. Do not expose the NF20MESH management interface to the internet or untrusted VLANs regardless of firmware version.