Description
Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter. User-controlled input is concatenated via sprintf() into the unquoted shell command `/etc/rrd/graphinterface %s %s` and executed by system() with root privileges. A remote authenticated attacker can inject arbitrary commands
Published: 2026-08-26
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in the update_interface_png handler of Comfast firmware, where a display_name input is unsanitized before being concatenated into an unquoted shell command. The command runs under root privileges via system(), permitting a remote authenticated attacker to inject arbitrary shell commands and execute them with full system privileges.

Affected Systems

Affected devices include Comfast CF‑N1‑S firmware version 2.6.0.1 and CF‑WR630AX dated 2024‑01‑30. No other vendors or products are listed as affected.

Risk and Exploitability

No CVSS or EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw allows direct command execution from an authenticated session on the web‑management interface, making it highly dangerous for any device that receives such traffic. Attackers would need legitimate credentials to the router’s web interface, after which the injection could execute arbitrary commands as root.

Generated by OpenCVE AI on August 26, 2026 at 22:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Comfast firmware update that resolves the command‑injection issue; if a patch is not yet released, consult the vendor for a fix timeline.
  • Limit access to the router’s web‑management interface to trusted internal networks or VPN tunnels, and disable any public exposure of the management UI.
  • If upgrading immediately is not possible, temporarily restrict or disable the /usr/bin/webmgnt update_interface_png handler or block execution of /etc/rrd/graphinterface via system restrictions.

Generated by OpenCVE AI on August 26, 2026 at 22:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 23:00:00 +0000

Type Values Removed Values Added
Title Remote Command Injection via Untrusted Input in Comfast CF‑N1‑S Firmware
Weaknesses CWE-20
CWE-78

Wed, 26 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Description Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter. User-controlled input is concatenated via sprintf() into the unquoted shell command `/etc/rrd/graphinterface %s %s` and executed by system() with root privileges. A remote authenticated attacker can inject arbitrary commands
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-26T20:41:18.875Z

Reserved: 2026-08-17T00:00:00.000Z

Link: CVE-2026-75364

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-26T21:16:40.970

Modified: 2026-08-26T21:16:40.970

Link: CVE-2026-75364

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T22:45:03Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')