Executive brief
NetComm NF20MESH routers, commonly used for home and small office internet connectivity, contain a security flaw that allows an authorized user to take full control of the device. By submitting a specially crafted username during account setup, an attacker can bypass security restrictions to run unauthorized commands. This could lead to the theft of sensitive configuration data, interception of network traffic, or a complete shutdown of the internet service.
Technical details
An OS command injection vulnerability exists in the dalStorage_addUserAccount function of NetComm NF20MESH routers. The vulnerability is caused by the unsafe concatenation of the 'username' JSON parameter into a shell command string (specifically a 'mkdir' command) which is then executed via rut_doSystemAction without proper sanitization. An authenticated attacker with low privileges can exploit this by injecting shell metacharacters into the username field. Successful exploitation grants full root-level access to the underlying Linux operating system. The issue is resolved in firmware version R6B032.
Affected products
- NetComm NF20MESH R6B031 and earlier
Timeline
- 2026-03-31: other: Vulnerability identified by Signal 11
- 2026-04-01: other: Initial vendor notification
- 2026-05-26: patched: Vendor provided patched version for testing
- 2026-06-18: other: Vendor advised fix was publicly released
- 2026-06-22: advisory: Signal 11 advisory published
- 2026-06-23: disclosed: NVD publication date
References
- https://signal11.io/advisories/netcomm-nf20-mesh-remote-code-execution
- https://support.netcommwireless.com/api/Media/Firmware/4407c21d-e990-49a4-9754-b72475f20c76?Product=NF20MESH%20Release%20Notes.pdf
- https://support.netcommwireless.com/products/nf20mesh
- https://www.vulncheck.com/advisories/netcomm-nf20mesh-r6b032-authenticated-rce-via-os-command-injection