CVE-2026-12814

Name of the Vulnerable Software and Affected Versions Comfast CF-WR631AX V3 versions prior to 2.7.0.8

Description A flaw in the API Endpoint component allows for remote OS command injection. This occurs through the manipulation of the destination argument within the function system of the '/cgi-bin/mbox-config?section=ping config' endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.