by Kastro
Paper/Archive/CVE-2026-15511

CVE-2026-15511

Comfast CF-WR631AX V3 — Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection

EPSS 5%public exploitCVSS 9.8
critical.is priorityof 100
58
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 91.9.919 × 2018.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected

ProductAffectedFixed inSource
CF-WR631AX V32.7.0.0–CNA
CF-WR631AX V32.7.0.1–CNA
CF-WR631AX V32.7.0.2–CNA
CF-WR631AX V32.7.0.3–CNA
CF-WR631AX V32.7.0.4–CNA
CF-WR631AX V32.7.0.5–CNA
CF-WR631AX V32.7.0.6–CNA
CF-WR631AX V32.7.0.7–CNA
CF-WR631AX V32.7.0.8–CNA

Scores by source

VulDB (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupvuldb.com/vuln/377840refvuldb.com/vuln/377840/ctiwriteupvuldb.com/cve/CVE-2026-15511writeupvuldb.com/submit/846719exploitgithub.com/luminarydawn/cve/tree/main/Command%20Injection%20in%20Comfast%20CF-WR631AX%20V3%20%E2%80%94%20WiFi%20Portal%20Image%20Upload%20(CWE-78)