Executive brief
Comfast CF-N1-S and CF-WR630AX are network access points used in homes and offices to provide WiFi and internet connectivity. A flaw in the web management interface allows an authenticated attacker to inject arbitrary system commands that execute with root privileges, potentially leading to complete device compromise, theft of WiFi credentials, installation of persistent backdoors, and lateral movement into the corporate or home network.
Technical details
The vulnerability is an OS command injection (CWE-77) in the update_interface_png SET handler within the /usr/bin/webmgnt binary. The handler fails to sanitize the display_name parameter before passing it to sprintf() to construct an unquoted shell command template (`/etc/rrd/graphinterface %s %s`), which is then executed by system() with root privileges. An authenticated attacker can inject arbitrary shell metacharacters (e.g., `;cmd;#`) into the display_name field via a POST request to /cgi-bin/mbox-config to achieve remote code execution. Authentication is required, but default credentials (admin/admin) are commonly unchanged. PoC code is publicly available.
Affected products
- Comfast CF-N1-S 2.6.0.1
- Comfast CF-WR630AX 2024-01-30 build (OpenWrt 21.02-SNAPSHOT r0-10d74dc)
Timeline
- 2026-08-26: disclosed