Quick answers
- Is CVE-2026-75363 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-75363 being exploited in the wild.
- How severe is CVE-2026-75363?
- Medium severity, with a CVSS score of 6.8, published 26 August 2026.
- Which products and versions are affected?
- Comfast CF-WR630AX v2.7.0.2.
- Is there a fix for CVE-2026-75363?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-75363 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2026-75363?
- Check whether you run Comfast CF-WR630AX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an OS command injection (CWE-77) in the /usr/bin/webmgnt FastCGI process handling NTP timezone configuration. The ntp_timezone SET handler uses sprintf() to directly concatenate user-controlled timestr parameter into a shell command template ("date -s \"%s\"") without escaping, then executes it via system() as root. An attacker can inject arbitrary commands by crafting a payload like x";cmd;# which breaks out of the quoted context. The attack requires prior authentication (POST to /cgi-bin/login with credentials) and a precondition that ntp_client_enabled is set to 0, but both are easily satisfied. PoC code is publicly available demonstrating file creation and command execution as root.
Affected products
- Comfast CF-WR630AX v2.7.0.2
Timeline
- 2026-08-26: disclosed