PT-2026-51523 · Netcomm Wireless Pty · Nf20Mesh

Brendan Scarvell · Publicado 2026-06-23 · Atualizado 2026-06-23 · CVE-2026-35019

Mitre

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded AES-256 key used to encrypt session cookies for the web management interface. Attackers can forge a valid encrypted session cookie using the shared hardcoded key and bypass authentication checks to obtain full administrative control of the management interface while any legitimate administrator session is active.

Correção

Enumeração de Fraquezas

CWE-321

Identificadores relacionados

CVE-2026-35019

Produtos afetados

Nf20Mesh

Referências · 5

• https://vulncheck.com/advisories/netcomm-nf20mesh-r6b032-hardcoded-aes-key-authentication-bypass · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-35019 · Nota de Segurança
• https://signal11.io/advisories/netcomm-nf20-mesh-authentication-bypass · Nota
• https://support.netcommwireless.com/api/Media/Firmware/4407c21d-e990-49a4-9754-b72475f20c76?Product=NF20MESH%20Release%20Notes.pdf · Correção
• https://support.netcommwireless.com/products/nf20mesh#Firmware · Nota