Hardcoded Key Enables Authentication Bypass in NetComm NF20MESH Routers

Signal 11 disclosed CVE-2026-35019, a critical (CVSS 9.2) authentication bypass in NetComm NF20MESH routers where a hardcoded AES-256 key enables forged session cookies and administrative takeover; the flaw affects firmware R6B031 and earlier, is fixed in R6B032, has an EPSS of 0.4% and no confirmed active exploitation, and administrators are advised to update immediately and restrict router exposure.