The vulnerability resides in the update_interface_png handler of Comfast firmware, where a display_name input is unsanitized before being concatenated into an unquoted shell command. The command runs under root privileges via system(), permitting a remote authenticated attacker to inject arbitrary shell commands and execute them with full system privileges.

Affected devices include Comfast CF‑N1‑S firmware version 2.6.0.1 and CF‑WR630AX dated 2024‑01‑30. No other vendors or products are listed as affected.

The flaw has a CVSS score of 6.8 and an EPSS score of less than 1%, indicating limited exploitation frequency but a moderate to high risk once an attacker has credentials. It is not listed in the CISA KEV catalog. An attacker who is able to log into the router’s web‑management interface can inject arbitrary shell commands into the unquoted system call used by the update_interface_png handler. The resulting privilege level is root, allowing the attacker to manipulate system configuration, install malware, or eavesdrop on network traffic. Exploitation requires legitimate credentials but may be feasible in environments where external access to the router’s management UI is available.