CVE-2026-35019 describes a critical authentication bypass vulnerability in NetComm Wireless Pty Ltd NF20MESH routers with firmware R6B031 and earlier. The vulnerability arises from the use of a hardcoded AES-256 key to encrypt session cookies for the router’s web management interface. An unauthenticated attacker can leverage this hardcoded key to forge encrypted session cookies, bypass authentication checks, and gain administrative control over the device’s management interface during any active legitimate administrator session.

Successful exploitation allows unauthenticated attackers to gain full administrative access to the router’s management interface. This compromises device integrity and control, potentially allowing configuration changes, network manipulation, or further attacks within the network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict access to the management interface and monitor for unauthorized access attempts.