Cyber Resilience

CVE-2026-35019

CriticalPublic PoC

Published: 23 June 2026

Published
23 June 2026
Modified
23 June 2026
KEV Added
—
Patch
—
CVSS Score v4 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0043 34.6th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-35019 is a critical-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Netcommwireless (inferred from references). Its CVSS base score is 9.2 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability details

NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded AES-256 key used to encrypt session cookies for the web management interface. Attackers can forge…

more

a valid encrypted session cookie using the shared hardcoded key and bypass authentication checks to obtain full administrative control of the management interface while any legitimate administrator session is active.

CWE(s)
CWE-321

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
attack.mitre.org →
T1606.001 Web Cookies Credential Access
Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.
attack.mitre.org →
Why these techniques?

Authentication bypass via hardcoded key enables forging web session cookies on public-facing router admin interface (T1190), directly facilitating use of forged cookies as alternate auth material (T1550.004) and web credential forgery (T1606.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

Netcommwireless
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SA-12 Supply Chain Protection
addresses: CWE-321

Supply chain protection includes scrutiny of cryptographic implementations, reducing hard-coded keys planted by untrusted vendors.

SA-4 Acquisition Process
addresses: CWE-321

Functional and assurance requirements specified in acquisition can prohibit hard-coded cryptographic keys in delivered products.

SC-12 Cryptographic Key Establishment and Management
addresses: CWE-321

Proper key establishment and management processes directly preclude embedding static cryptographic keys in source code or binaries.

SC-17 Public Key Infrastructure Certificates
addresses: CWE-321

Approved PKI issuance and trust stores replace ad-hoc or hard-coded keys with properly managed, signed certificates.

SR-6 Supplier Assessments and Reviews
addresses: CWE-321

Assessments can uncover and prevent suppliers from shipping components that contain hard-coded cryptographic keys.

References