Description
A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8. This issue affects the function system of the file /cgi-bin/mbox-config?section=ping_config of the component API Endpoint. This manipulation of the argument destination causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-06-21
Score: 5.3 Medium
EPSS: 1.2% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw allows an attacker to inject arbitrary operating‑system commands by manipulating the 'destination' parameter in the /cgi-bin/mbox-config?section=ping_config API endpoint. The injection can be executed remotely, giving the attacker full control over the device’s operating system. The weakness maps to CWE-77 and CWE-78, representing Command Injection and OS Command Injection respectively.

Affected Systems

The vulnerability affects Comfast CF‑WR631AX V3 firmware versions up to 2.7.0.8. Only devices running affected firmware are impacted; newer firmware releases may have the fix.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score of 1% indicates a low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but published exploits exist. The attack can be carried out remotely via the API endpoint, and the description indicates that no authentication is required, though this is inferred from the wording of the data.

Generated by OpenCVE AI on June 24, 2026 at 11:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware release from Comfast that removes the vulnerable endpoint or patches the command injection flaw.
  • Configure network perimeter devices or the router’s firewall to block access to the /cgi-bin/mbox-config endpoint from untrusted networks.
  • Perform a security review of the router’s configuration to ensure that no other API endpoints or settings expose command execution capabilities.

Generated by OpenCVE AI on June 24, 2026 at 11:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 22 Jun 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 21 Jun 2026 23:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8. This issue affects the function system of the file /cgi-bin/mbox-config?section=ping_config of the component API Endpoint. This manipulation of the argument destination causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection
First Time appeared Comfast
Comfast cf-wr631ax V3
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:comfast:cf-wr631ax_v3:*:*:*:*:*:*:*:*
Vendors & Products Comfast
Comfast cf-wr631ax V3
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Comfast Cf-wr631ax V3
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-22T12:07:51.156Z

Reserved: 2026-06-21T06:22:24.256Z

Link: CVE-2026-12814

cve-icon Vulnrichment

Updated: 2026-06-22T12:07:48.359Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-24T12:00:05Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')