The flaw lies in the use of a hard‑coded AES‑256 key that encrypts session cookies for the device’s web management interface. Because the key is embedded in the firmware, an attacker can craft a valid session cookie and present it to the router, causing the authentication check to accept the cookie as authentic. This yields unrestricted administrative access even while a legitimate administrator is logged in. The weakness is a classic example of insecure key management (CWE‑321).

NetComm Wireless Pty Ltd’s NF20MESH routers running firmware R6B031 and earlier are affected. These wireless access points can be deployed in both enterprise and residential environments.

The vulnerability’s CVSS of 9.2 indicates critical severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, suggesting no known public exploits yet. Based on the description, the likely attack vector is inferred to be remote network access to the router’s web interface. The ease of forging a session cookie makes the risk high until remediation is applied.