CVE-2026-35019 | NetComm NF20MESH routers running firmware R6B031 and earlier… | CVSS 8.1 HIGH

Description

NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded AES-256 key used to encrypt session cookies for the web management interface. Attackers can forge a valid encrypted session cookie using the shared hardcoded key and bypass authentication checks to obtain full administrative control of the management interface while any legitimate administrator session is active.

Metadata

CVE ID: CVE-2026-35019
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-03-31 20:40 UTC
Published: 2026-06-23 13:48 UTC
Last updated: 2026-06-23 15:11 UTC
Primary CWE: CWE-321
Use of Hard-coded Cryptographic Key
Vendor / Product: NetComm Wireless Pty Ltd / NF20MESH
Sources: cve.org · NVD

Severity & Metrics

8.1 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
NetComm Wireless Pty Ltd	NF20MESH	—	0 < R6B032

Weakness (CWE)

CWE	Source	Description
CWE-321	cna	Use of Hard-coded Cryptographic Key

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.2	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.1	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References (4)