Luminarydawn

**Name of the Vulnerable Software and Affected Versions** Comfast CF-WR631AX V3 versions prior to 2.7.0.8 **Description** An OS command injection flaw exists in the FastCGI Backend component within the `/usr/bin/webmgnt` file. The issue occurs in the `system wl upload pic file()` function when processing the `filename` argument, allowing a remote attacker to execute arbitrary operating system commands. **Recommendations** Update Comfast CF-WR631AX V3 to a version newer than 2.7.0.8. As a temporary mitigation, restrict access to the `system wl upload pic file()` function within the FastCGI Backend component.