PT-2026-82303 · Comfast · Cf-N1-S+1
CVE-2026-75364
·
Published
2026-08-26
·
Updated
2026-08-31
CVSS v3.1
6.8
Medium
| Vector | AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Comfast CF-N1-S version 2.6.0.1
Comfast CF-WR630AX version 2024-01-30 build
Description
The
update interface png SET handler in /usr/bin/webmgnt fails to sanitize the display name parameter. User-controlled input is concatenated via sprintf() into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by system() with root privileges. This allows a remote authenticated attacker to inject and execute arbitrary commands.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cf-N1-S
Cf-Wr630Ax