CVE-2026-35019
High · 8.1CVSS
8.1
EPSS
0.8%
Published
Jun 23, 2026
CISA due date
—
The record
NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded AES-256 key used to encrypt session cookies for the web management interface. Attackers can forge a valid encrypted session cookie using the shared hardcoded key and bypass authentication checks to obtain full administrative control of the management interface while any legitimate administrator session is active.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-79735 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78486 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78481 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-53939 OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption… CWE-321
- CVE-2026-81821 The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards… CWE-321
- CVE-2026-80057 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78487 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-80114 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and… CWE-321