CVE-2026-35018: NetComm NF20MESH Authenticated RCE via Shell Injection

Technical summary

The vulnerability exists in the dalStorage_addUserAccount function, which processes user input from a JSON username parameter without sanitization before passing it to rut_doSystemAction for shell execution. The unsafe concatenation allows shell metacharacters (such as backticks, semicolons, pipes, or command substitution syntax) embedded in the username to break out of the intended command context and execute arbitrary system commands with root privileges. This is a classic OS command injection flaw (CWE-78) that exploits the router's failure to escape or validate user-controlled data before shell invocation.

Business impact

Compromised routers can be used as persistent backdoors for lateral network movement, credential harvesting, DNS hijacking, or deployment of malware across connected networks. For organizations relying on NetComm devices in branch offices or remote sites, exploitation could lead to full compromise of network segments, data exfiltration, or service disruption. The ability to execute commands as root means attackers can modify firewall rules, intercept traffic, or persist across reboots.

Affected systems

NetComm NF20MESH routers running firmware version R6B031 or earlier are vulnerable. Organizations should verify their installed firmware versions immediately. NetComm has not provided information on later firmware versions that may or may not contain fixes; consult vendor advisories for confirmed patched versions.

Exploitability

Exploitation requires valid authentication credentials for the router's administrative interface. The attack vector is network-based and does not require user interaction once an attacker has login access. The attack complexity is low—injection of shell metacharacters into a username field is straightforward. The barrier to entry is credential acquisition, which could occur through phishing, credential stuffing, default credentials, or prior network compromise.

Remediation

Apply the latest firmware update from NetComm for the NF20MESH model. If patched firmware is unavailable, restrict administrative access to trusted IP ranges via firewall rules, enforce strong unique administrative passwords, disable remote management interfaces if not required, and monitor account creation logs for suspicious usernames containing shell metacharacters. Verify patch availability and version numbers against the vendor's official security advisory before deployment.

Patch guidance

Check NetComm's security portal or contact support to confirm the latest patched firmware version for the NF20MESH. Firmware R6B032 and later versions should be validated against the vendor advisory before deployment. Test patches in a non-production environment first. After patching, verify that the device functions correctly and that any configuration scripts or integrations continue to operate as expected.

Detection guidance

Monitor router administrative logs for account creation events containing suspicious characters in usernames (backticks, $(), semicolons, pipes, tildes, or other shell metacharacters). Review system command execution logs for unexpected root-level activities following user account modifications. Network-based detection is difficult without access to application logs; prioritize log monitoring and access control reviews. Consider scanning for exposed administrative interfaces using network discovery tools and flag any accessible NetComm devices for immediate credential and firmware review.

Why prioritize this

This vulnerability scores 8.8 (HIGH) on CVSS 3.1 due to high impact across confidentiality, integrity, and availability combined with low attack complexity. Although it requires prior authentication, the post-authentication escalation to unauthenticated root command execution creates substantial risk. Organizations should treat this as high priority, especially if NF20MESH routers are internet-facing, accessible to untrusted internal users, or deployed in critical network segments.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network-based attack vector with no special access required after authentication; (2) Low attack complexity—shell injection is trivial to execute; (3) Low privileges required—only authenticated user access; (4) No user interaction required; (5) High impact to all three security pillars (confidentiality, integrity, availability via root command execution). The score would be higher if the vulnerability were unauthenticated, but the requirement for valid credentials limits the overall severity slightly.

Frequently asked questions