A flaw in the webmggnt component of Comfast CF-E7 routers allows attackers to manipulate the "/cgi-bin/mbox-config?method=SET&section=ping_config" API. The vulnerable code accepts a "destination" parameter and passes its value directly into a system call, resulting in command injection. Successful exploitation provides an attacker with the ability to execute arbitrary shell commands on the device, enabling full control, data theft, or configuration tampering.

The vulnerability affects Comfast CF‑E7 routers running firmware 2.6.0.9. No evidence indicates that earlier firmware releases are immune; the exposed CGI script is present only in the reported version. Users should specifically check the firmware version deployed on their devices against the stated value.

The CVSS base score of 5.3 signifies moderate severity, while the EPSS score of 9% indicates a relatively high probability of exploitation. Attack is performed remotely through the router’s web management interface and requires no local privileges. If an attacker injects commands, they effectively gain administrative control, making this a moderate to high risk for routers exposed to untrusted networks. The vulnerability is not currently listed in the CISA KEV catalog.