CVE-2026-35018 is an authenticated remote code execution vulnerability in NetComm Wireless NF20MESH routers running firmware R6B031 and earlier. The vulnerability exists in the dalStorage_addUserAccount function, which processes a username JSON parameter. Due to improper neutralization of special shell characters, an attacker can inject commands that are concatenated unsafely into a shell command string passed to rut_doSystemAction. This allows execution of arbitrary commands with root privileges on the underlying OS.

Successful exploitation grants an authenticated attacker full root-level command execution on the affected router. This can compromise device integrity, confidentiality, and availability, potentially allowing complete control over the device and its network functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the router's management interface to trusted users only and monitor for suspicious activity. Avoid using vulnerable firmware versions if possible.