CVE-2026-15511

Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection

View on CVE.org
Published Jul 12, 2026 CVSS 4.0 · 9.3 Critical EPSS 4.7% KEV · Not listed
Description
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability allows an attacker to inject arbitrary operating system commands through the filename parameter of the system_wl_upload_pic_file function in the FastCGI Backend web management component. This improper handling of user input can lead to remote code execution, providing the attacker with complete control over the affected device. The weakness is a classic command injection scenario, classified under CWE‑77 and CWE‑78.

Affected Systems

Devices running the Comfast CF‑WR631AX V3 firmware up to version 2.7.0.8 are affected. The flaw exists specifically in the webmgnt interface located at */usr/bin/webmgnt* and involves the image upload functionality exposed by the system_wl_upload_pic_file endpoint.

Risk and Exploitability

The CVSS score of 9.3 marks this flaw as a critical risk. The EPSS score of 5% indicates a higher exploitation probability, and the vulnerability has already been publicly disclosed and is likely to have active exploitation. The lack of a KEV listing does not reduce the severity, as the exploit path remains straightforward: a remote attacker can trigger the upload endpoint and supply a specially crafted filename to execute arbitrary commands on the device.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the device to a firmware revision newer than 2.7.0.8 where the webmgnt component is patched to validate or sanitize the filename parameter.
  • Disable or restrict access to the webmgnt upload functionality via network segmentation or firewall rules, preventing unauthorized remote attackers from reaching the vulnerable endpoint.
  • Implement strict input validation for filename inputs, ensuring that no shell metacharacters or paths can be injected, thereby mitigating the command injection risk.
  • Actively monitor logs for anomalous upload attempts and anomalous commands executed through the web management interface.

Generated by OpenCVE AI on August 24, 2026 at 16:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection
First Time appeared Comfast
Comfast cf-wr631ax V3
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:comfast:cf-wr631ax_v3:*:*:*:*:*:*:*:*
Vendors & Products Comfast
Comfast cf-wr631ax V3
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 14, 2026, 2:48 PM
Reserved
Jul 12, 2026, 6:00 AM

View source JSON

Updated
Jul 14, 2026, 2:48 PM

JSON

Status
Deferred
Published
Jul 12, 2026, 11:16 PM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Aug 24, 2026, 4:30 PM

JSON