A command injection vulnerability exists in the Comfast CF-AC100 firmware 2.6.0.8, affecting the function exposed via the URL /cgi-bin/mbox-config?method=SET&section=update_interface_png. Overworking this function allows an attacker to inject arbitrary shell commands, enabling remote execution of code on the device. The vulnerability is a classic example of input validation weaknesses, as indicated by the associated CWEs (CWE-74, CWE-77). The impact is the ability for an attacker to compromise confidentiality, integrity, and availability of the affected device and potentially use it as an entry point into the local network.

Affected systems are Comfast CF-AC100 routers running firmware version 2.6.0.8. No older or newer versions are listed as affected, and no other product variants were identified in the available data.

The CVSS score of 5.1 indicates moderate severity, and the absence of an EPSS score or KEV listing suggests the risk is not yet formally quantified in public exploit metrics. The attack vector is remote, exploiting the web‑based configuration interface without needing local access or prior authentication. Because the vulnerability is publicly disclosed, it is possible for attackers to craft malicious requests and trigger command injection with relative ease.