Executive brief
The Comfast CF-WR630AX router's web management interface contains a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands with root privileges. An attacker who gains access to the router's management console can inject malicious commands through the time zone configuration parameter, leading to complete device compromise, credential theft, and potential lateral movement into the network.
Technical details
The vulnerability is an OS command injection (CWE-77) in the /usr/bin/webmgnt FastCGI process handling NTP timezone configuration. The ntp_timezone SET handler uses sprintf() to directly concatenate user-controlled timestr parameter into a shell command template ("date -s \"%s\"") without escaping, then executes it via system() as root. An attacker can inject arbitrary commands by crafting a payload like x";cmd;# which breaks out of the quoted context. The attack requires prior authentication (POST to /cgi-bin/login with credentials) and a precondition that ntp_client_enabled is set to 0, but both are easily satisfied. PoC code is publicly available demonstrating file creation and command execution as root.
Affected products
- Comfast CF-WR630AX v2.7.0.2
Timeline
- 2026-08-26: disclosed