Comfast CF-WR630AX EUVD-2026-66743

Two concrete prerequisites must both be satisfied: (1) Adjacent network access - the attacker must be on the same LAN segment or WiFi network as the device; remote exploitation from the internet is not possible without first breaching the network perimeter. (2) High-privilege credentials - administrator-level access to the Comfast web management interface is required (PR:H per CVSS vector). The specific injection points are the 'timestr' and 'display_n' parameters submitted to the /cgi-bin/mbox-config endpoint and processed by /usr/bin/webmgnt. Exploitation is limited by the need to simultaneously control an adjacent-network position and hold admin credentials - however, SOHO devices are frequently deployed with default credentials (admin/admin), which may make the credential requirement trivially satisfiable in practice. No specific non-default configuration flag or feature toggle is identified as a prerequisite beyond standard web management being accessible.

The CVSS 3.1 score of 6.8 (Medium) reflects two significant real-world mitigators baked into the vector: AV:A (attacker must be on the same network segment as the device - not directly exploitable from the internet) and PR:H (admin-level credentials are required). In practice, SOHO router admin interfaces are often accessible with default or weak credentials, potentially lowering the real-world privilege bar below what PR:H implies. The publicly available PoC on GitHub (confirmed) increases the risk of opportunistic exploitation by lower-skill attackers who have already gained LAN access. Conversely, the EPSS score of 0.19% (9th percentile) confirms no widespread exploitation is currently observed, consistent with the adjacency constraint. No CISA KEV listing. The overall posture is: meaningful targeted risk for devices deployed with default credentials on reachable network segments, but not a mass-exploitation scenario.

An attacker who has gained adjacent network access to the router's LAN segment - for example, through a compromised internal host or weak WiFi PSK - and possesses admin credentials (e.g., factory defaults) sends a crafted HTTP POST to /cgi-bin/mbox-config with a shell-metacharacter-injected value in the 'timestr' or 'display_n' parameter. The web management process passes the payload unsanitized to the OS shell, executing arbitrary commands as root. The public GitHub PoC demonstrates the injection technique, reducing attacker skill requirements for anyone already meeting the adjacency and credential prerequisites.