The flaw lies in the use of a hard‑coded AES‑256 key to encrypt session cookies for the vendor’s web management interface. An attacker can generate a valid encrypted cookie using the known key; the device then mistakenly accepts the cookie as authenticated. This bypass grants unauthenticated users full administrative privileges, even while a legitimate administrator is logged in. The weakness is a classic case of insecure key management (CWE‑321).

NetComm Wireless Pty Ltd’s NF20MESH routers running firmware version R6B031 and earlier are affected. These wireless access points can be deployed in both enterprise and residential environments.

The vulnerability has a CVSS score of 9.2, indicating critical severity. EPSS data is not available. Based on the description, the likely attack vector is inferred to be remote network access to the device’s web interface. The flaw is not listed in the CISA KEV catalog, suggesting no known public exploits yet; however, the ease of cookie forgery means the risk surface remains high and the vulnerability should be treated as a critical asset risk until patched.