CVE-2026-35019 describes an authentication bypass vulnerability in NetComm Wireless Pty Ltd NF20MESH routers running firmware R6B031 and earlier. The issue arises from the use of a hardcoded AES-256 key to encrypt session cookies for the router's web management interface. An attacker can leverage knowledge of this key to forge valid encrypted session cookies, bypassing authentication controls and obtaining full administrative privileges on the device's management interface during an active legitimate administrator session. This vulnerability is critical, with a CVSS 4.0 base score of 9.2, indicating network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the vulnerability is not related to a cloud service.

Successful exploitation allows unauthenticated attackers to bypass authentication and gain full administrative control over the NF20MESH router's web management interface. This compromises device confidentiality, integrity, and availability, potentially allowing attackers to alter configurations, disrupt network operations, or further pivot into internal networks. The vulnerability requires an active legitimate administrator session to be present for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the router's management interface to trusted networks and users only. Monitor for unusual administrative sessions and consider rebooting devices to terminate active sessions. Avoid exposing the management interface to untrusted networks.