CVE-2026-35019: NetComm NF20MESH < R6B032 Hardcoded AES Key Authentication Bypass

Synopsis

This is an authentication bypass vulnerability in the NetComm NF20MESH router firmware (versions prior to R6B032). The router's web management interface encrypts session cookies using a hardcoded AES-256 key, meaning any attacker who knows the key (which is static and extractable from the firmware) can forge a valid session cookie and gain full administrative access without any credentials. Exploitation requires no authentication and is reachable over the network while a legitimate admin session is active, giving the attacker complete administrative control of the device. A patched-image rebuild at firmware version R6B032 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The web management interface is exposed over the network, so the attacker must be able to reach it remotely over TCP to deliver the forged session cookie.

• AuthenticationNot required

  No credentials are needed; the hardcoded AES-256 key allows the attacker to forge a valid session cookie and bypass all authentication checks entirely.

• Victim interactionRequired

  A legitimate administrator session must be active at the time of the attack, as the bypass depends on the presence of a valid concurrent admin session on the management interface.

• Attack complexityDetail

  The base exploit is reliable and condition-free once the attacker has the hardcoded key (extractable from firmware), though the attack target (AT:P) indicates a specific prerequisite condition, specifically an active admin session, must be met.

Blast Radius

• Reads all router configuration data, including stored Wi-Fi credentials, VPN keys, and connected-device records.
• Modifies network routing rules, DNS settings, and firewall policies across the device.
• Adds rogue administrative accounts or removes existing ones, locking out legitimate administrators.
• Crashes or restarts the management interface or connected services, disrupting network availability for all devices on the segment.