Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

CVE-2026-35019

NetComm NF20MESH < R6B032 Hardcoded AES Key Authentication Bypass

NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded AES-256 key used to encrypt session cookies for the web management interface. Attackers can forge a valid encrypted session cookie using the shared hardcoded key and bypass authentication checks to obtain full administrative control of the management interface while any legitimate administrator session is active.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Netcommwireless
Products
Nf20mesh
CVE-2026-35018

NetComm NF20MESH < R6B032 Authenticated RCE via OS Command Injection

NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the username JSON parameter processed by the dalStorage_addUserAccount function. Attackers can exploit the unsafe concatenation of user-supplied input into a shell command string passed to rut_doSystemAction without sanitization to achieve full root-level command execution on the underlying operating system.

CVSS 4.0 · 8.7 High EPSS 1.3% KEV · Not listed
Vendors
Netcommwireless
Products
Nf20mesh
CVE-2022-4874

Authenticated bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows unauthenticated user to get access to content.

Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content. In order to serve static content, the application performs a check for the existence of specific characters in the URL (.css, .png etc). If it exists, it performs a "fake login" to give the request an active session to load the file and not redirect to the login page.

CVSS 3.1 · 7.5 High EPSS 11.0% KEV · Not listed
Vendors
Netcommwireless
Products
Nf20 Nf20 Firmware Nf20mesh and 3 more
CVE-2022-4873

Stack based overflow on Netcomm router models NF20MESH, NF20, and NL1902

On Netcomm router models NF20MESH, NF20, and NL1902 a stack based buffer overflow affects the sessionKey parameter. By providing a specific number of bytes, the instruction pointer is able to be overwritten on the stack and crashes the application at a known location.

CVSS 3.1 · 9.8 Critical EPSS 7.2% KEV · Not listed
Vendors
Netcommwireless
Products
Nf20 Nf20 Firmware Nf20mesh and 3 more