EUVD-2026-38200
GHSA-fvx9-6cqj-p3f8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for required authentication; S:C and H/H/H because OS command injection on router firmware breaks application boundary, yielding full system root access.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8. This issue affects the function system of the file /cgi-bin/mbox-config?section=ping_config of the component API Endpoint. This manipulation of the argument destination causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
OS command injection in Comfast CF-WR631AX V3 firmware (versions 2.7.0.0 through 2.7.0.8) allows an authenticated remote attacker to execute arbitrary operating system commands by injecting shell metacharacters into the destination parameter of the ping configuration API endpoint at /cgi-bin/mbox-config?section=ping_config. A detailed public exploit analysis report is available on GitHub, materially lowering the exploitation barrier, though no CISA KEV listing confirms active in-the-wild campaigns at time of analysis. The vendor was notified prior to disclosure and did not respond, leaving all known firmware versions without a patch.
Technical ContextAI
The vulnerability resides in a CGI-based API handler on the Comfast CF-WR631AX V3 SOHO wireless router, identified by CPE cpe:2.3:a:comfast:cf-wr631ax_v3:*:*:*:*:*:*:*:*. The affected code path invokes the C standard library system() function - or an equivalent shell-dispatch call - within the ping configuration handler at /cgi-bin/mbox-config?section=ping_config, passing user-supplied input from the destination argument directly to the shell without sanitization or allowlist validation. CWE-78 (Improper Neutralization of Special Elements Used in an OS Command) describes this root cause: the application constructs an OS command string using untrusted data, enabling shell metacharacter injection (semicolons, pipes, backticks, dollar-sign subshells) that the underlying shell interprets as additional commands. Embedded router firmware of this class commonly runs as root or a privileged daemon, meaning injected commands execute with elevated OS privileges. The CGI interface is a common attack surface on SOHO devices and is frequently accessible on the LAN-side management interface and, when remote management is enabled, on the WAN interface.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to responsible disclosure. The primary mitigation is to immediately restrict network access to the router's administrative management interface: disable WAN-side remote management if enabled (preventing external attackers from reaching the CGI endpoint), and restrict LAN-side access to the admin interface to trusted management hosts only using access control lists or VLAN segmentation - this limits the pool of authenticated users who can reach /cgi-bin/mbox-config. If the device cannot be adequately isolated, replace it with supported hardware from a vendor with an active security response program, as the vendor's non-response indicates no remediation path is forthcoming. Enforce strong, non-default administrative credentials to raise the credential-acquisition bar, since exploitation requires PR:L authentication. Monitor VulDB entry https://vuldb.com/vuln/372608 and the public PoC repository at https://github.com/0xcc12138/COMFAST-CF-WR631AX-Router-Backend-Command-Injection-RCE-Analysis-Report for any firmware updates or additional technical details.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today