Vulnerability Description
NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded AES-256 key used to encrypt session cookies for the web management interface. Attackers can forge a valid encrypted session cookie using the shared hardcoded key and bypass authentication checks to obtain full administrative control of the management interface while any legitimate administrator session is active.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://signal11.io/advisories/netcomm-nf20-mesh-authentication-bypass
- https://support.netcommwireless.com/api/Media/Firmware/4407c21d-e990-49a4-9754-b
- https://support.netcommwireless.com/products/nf20mesh#Firmware
- https://www.vulncheck.com/advisories/netcomm-nf20mesh-r6b032-hardcoded-aes-key-a
FAQ
What is CVE-2026-35019?
CVE-2026-35019 is a vulnerability with a CVSS score of 8.1 (HIGH). NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcode...
How severe is CVE-2026-35019?
CVE-2026-35019 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-35019?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.