EUVD-2026-43252
GHSA-hpmx-855m-f9m5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated injection with no user interaction (AV:N/AC:L/PR:N/UI:N); command execution as the router daemon yields full C/I/A impact with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
OS command injection in the Comfast CF-WR631AX V3 WiFi router (firmware through 2.7.0.8) lets remote attackers execute arbitrary operating-system commands by manipulating the filename argument in the system_wl_upload_pic_file routine of the /usr/bin/webmgnt FastCGI backend. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation, and publicly available exploit code exists (E:P). It is not listed in CISA KEV, so there is no confirmed active exploitation, but the public disclosure lowers the barrier for opportunistic attacks against exposed devices.
Technical ContextAI
The affected component is the embedded web management daemon (/usr/bin/webmgnt) that handles the router's administrative web UI over a FastCGI backend. The vulnerable function system_wl_upload_pic_file processes an image/picture upload feature associated with the WiFi portal and passes the user-controlled filename into an OS-level command (e.g., via system()/popen() or shell string construction) without sanitization. This is a classic CWE-77 command injection (the referencing advisory labels it CWE-78, OS command injection specifically): attacker-controlled input reaches a command interpreter, letting shell metacharacters in the filename break out of the intended command and run arbitrary commands with the privileges of the web daemon, which on SOHO routers is typically root.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor was contacted early but did not respond, and no fixed firmware version is available. Because a code-level fix is unavailable, apply compensating controls: ensure the web-management interface is never exposed to the WAN/Internet (block inbound access to the HTTP/HTTPS admin ports at the network edge), and restrict administrative access to a trusted management VLAN or specific admin IPs, accepting the trade-off of less convenient remote administration. Disable or avoid using the WiFi-portal image-upload feature if the device permits it, since that is the injection entry point. Given the vendor's non-response and lack of a patch, seriously consider replacing the device with a supported model for any security-sensitive deployment. Monitor the VulDB entry (https://vuldb.com/cve/CVE-2026-15511) and the public advisory (https://github.com/luminarydawn/cve) for any future fix.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today