NetComm NF20MESH routers running firmware releases R6B031 and earlier are vulnerable to an authenticated remote code execution flaw. An attacker who has valid credentials can send a crafted JSON payload that injects shell metacharacters into the username field processed by the dalStorage_addUserAccount function. Because the username is concatenated into a shell command passed to rut_doSystemAction without sanitization, the attacker can execute arbitrary commands as the root user on the underlying operating system. The vulnerability is a classic OS command injection (CWE‑78) that allows injection of arbitrary shell commands.

The flaw affects NetComm Wireless Pty Ltd’s NF20MESH router. Firmware versions R6B031 and all earlier releases are impacted; firmware R6B032 or later is not confirmed to be affected but is not indicated as vulnerable in the input.

The CVSS score of 8.7 indicates a high severity vulnerability. No EPSS score is publicly available, and the issue is not listed in the CISA KEV catalog, suggesting limited known exploit activity. Exposing the management interface, an attacker must first authenticate and then dispatch a malicious JSON request to trigger the unvalidated shell command. If successful, the attacker gains full root‑level control of the device’s operating system, enabling arbitrary code execution, data exfiltration, or further network attacks.