CVE-2026-35019

Name of the Vulnerable Software and Affected Versions NetComm NF20MESH versions prior to R6B032

Description An authentication bypass exists in the web management interface due to a hardcoded AES-256 key used to encrypt session cookies. An unauthenticated attacker can use this shared key to forge a valid encrypted session cookie and gain full administrative control of the interface, provided a legitimate administrator session is active.

Recommendations Update to firmware R6B032.