CVE-2026-35018
NetComm NF20MESH < R6B032 Authenticated RCE via OS Command Injection
- State
- Published
- Severity
- 8.7 High
- Published
- Jun 23, 2026
- Updated
- Jul 14, 2026
- Reserved
- Mar 31, 2026
Description
NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the username JSON parameter processed by the dalStorage_addUserAccount function. Attackers can exploit the unsafe concatenation of user-supplied input into a shell command string passed to rut_doSystemAction without sanitization to achieve full root-level command execution on the underlying operating system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
NF20MESHNetComm Wireless Pty Ltd |
|
References
- https://signal11.io/advisories/netcomm-nf20-mesh-remote-code-executiontechnical-description
- https://support.netcommwireless.com/api/Media/Firmware/4407c21d-e990-49a4-9754-b72475f20c76?Product=NF20MESH%20Release%20Notes.pdfrelease-notespatch
- https://support.netcommwireless.com/products/nf20mesh#Firmwareproduct
- https://www.vulncheck.com/advisories/netcomm-nf20mesh-r6b032-authenticated-rce-via-os-command-injectionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.