CVE-2026-35018: NetComm NF20MESH Router RCE Vulnerability

CVE-2026-35018 Overview

CVE-2026-35018 is an authenticated operating system command injection vulnerability affecting NetComm NF20MESH routers running firmware R6B031 and earlier. The flaw resides in the dalStorage_addUserAccount function, which concatenates the user-supplied username JSON parameter into a shell command string passed to rut_doSystemAction without sanitization. Authenticated attackers can inject shell metacharacters to execute arbitrary commands as root on the underlying Linux operating system. The weakness is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
Authenticated attackers can achieve full root-level command execution on affected NetComm NF20MESH routers, enabling complete device takeover, traffic interception, and pivoting into adjacent network segments.

Affected Products

NetComm NF20MESH router firmware R6B031
NetComm NF20MESH router firmware versions earlier than R6B031
NetComm NF20MESH mesh Wi-Fi gateway hardware shipping with vulnerable firmware

Discovery Timeline

2026-06-23 - CVE-2026-35018 published to the National Vulnerability Database
2026-06-24 - Last updated in the NVD database

Technical Details for CVE-2026-35018

Vulnerability Analysis

The vulnerability exists in the storage user-account management code path of the NF20MESH firmware. When an authenticated client submits a JSON request to add a storage user account, the dalStorage_addUserAccount function reads the username field directly from the request body. The function builds a shell command string by concatenating the attacker-controlled value into a fixed command template. That string is then handed to rut_doSystemAction, which executes it through a system shell running as root. Because no input filtering, escaping, or argument-array execution is performed, any shell metacharacter in the username value terminates the intended command and starts a new one.

Root Cause

The root cause is unsafe string concatenation of untrusted input into a shell command line. The username parameter is treated as a benign identifier, but the application never validates the character set, length, or presence of shell control characters such as `, $(), ;, |, &, or newline. Combined with the use of a shell interpreter rather than a direct execve with an argument vector, this produces a classic OS command injection primitive.

Attack Vector

Exploitation requires valid credentials to the router management interface, which is reachable over the network. An authenticated attacker sends a crafted JSON request to the storage user-account endpoint that triggers dalStorage_addUserAccount. The username field is populated with shell metacharacters wrapping an arbitrary command payload. When the backend executes the constructed string, the injected command runs as root, allowing the attacker to modify firmware configuration, enable remote services, exfiltrate credentials from nvram, or stage persistent backdoors. The Signal11 and VulnCheck advisories provide additional detail on the exact request structure.

No verified public proof-of-concept code is included in this analysis. Refer to the Signal11 Remote Code Execution Advisory and the VulnCheck Authenticated RCE Advisory for technical specifics.

Detection Methods for CVE-2026-35018

Indicators of Compromise

HTTP requests to the router management interface containing JSON bodies where the username field includes shell metacharacters such as `, $(), ;, |, or &.
Unexpected child processes spawned by the router web service such as sh, wget, curl, nc, or telnetd shortly after a storage user-account API call.
New listening sockets, modified nvram values, or unauthorized firmware configuration changes following an authenticated session.
Outbound connections from the router to attacker-controlled infrastructure immediately after administrative authentication events.

Detection Strategies

Inspect router HTTP/HTTPS management traffic for JSON parameters containing shell control characters and alert on the username field specifically.
Forward router syslog and authentication events to a centralized SIEM or data lake and correlate successful logins with subsequent configuration-changing API calls.
Baseline the expected process tree of the router web service so that any execution of shell utilities triggered by the management daemon is flagged as anomalous.

Monitoring Recommendations

Enable verbose logging on the NetComm management interface and ship logs off-device to prevent local tampering after compromise.
Monitor for unauthorized changes to administrator credentials, DNS settings, and port-forwarding rules on NF20MESH devices.
Track firmware version inventory and alert when devices report versions R6B031 or earlier in management telemetry.

How to Mitigate CVE-2026-35018

Immediate Actions Required

Upgrade NF20MESH firmware to the fixed release published by NetComm; review the NetComm Firmware Release Notes and the NetComm NF20MESH Firmware Information page for the current build.
Rotate all administrative credentials on affected devices, because the vulnerability requires authentication and any prior credentials may have been exposed.
Restrict access to the router management interface to trusted management VLANs or specific source IP addresses.
Audit recent configuration, user account, and firmware changes for signs of unauthorized modification.

Patch Information

NetComm has published updated firmware that addresses the OS command injection in dalStorage_addUserAccount. Administrators should consult the vendor release notes and apply the post-R6B031 firmware build to all deployed NF20MESH units. The VulnCheck Authenticated RCE Advisory references R6B032 in its title as the fixed track.

Workarounds

Disable remote (WAN-side) administration of the router and restrict the LAN-side management interface to a dedicated administrative network.
Enforce strong, unique administrator passwords and disable any default accounts to raise the bar for the authentication precondition.
Place vulnerable devices behind a network access control list that blocks untrusted hosts from reaching the management HTTP service until the firmware update is applied.

bash

# Example: restrict router management access to a single admin host using an upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <admin_host_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 80  -s <admin_host_ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80  -j DROP