CVE-2026-15511 in CF-WR631AX V3
Summary
by MITRE • 07/13/2026
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/13/2026
This vulnerability exists within the Comfast CF-WR631AX V3 router firmware version 2.7.0.8 and earlier, specifically affecting the FastCGI Backend component through the system_wl_upload_pic_file function in the /usr/bin/webmgnt binary. The flaw represents a critical command injection vulnerability that allows remote attackers to execute arbitrary operating system commands on the affected device. The vulnerability stems from improper input validation within the filename argument processing, where user-supplied data is directly incorporated into system commands without adequate sanitization or escaping mechanisms. This type of vulnerability falls under CWE-77 which categorizes improper neutralization of special elements used in OS commands, making it particularly dangerous as it enables full system compromise through remote exploitation.
The operational impact of this vulnerability is severe and far-reaching given that the attack can be initiated remotely without authentication requirements. An attacker can leverage this command injection flaw to gain complete control over the router's operating system, potentially accessing network traffic, modifying firewall rules, installing malicious firmware, or using the device as a pivot point for further attacks within the local network. The fact that the exploit has been publicly disclosed significantly increases the risk profile as it provides threat actors with readily available attack vectors. This vulnerability directly maps to ATT&CK technique T1059.001 for Command and Scripting Interpreter, specifically through the use of operating system command shells which can be leveraged for privilege escalation and lateral movement.
The technical exploitation occurs through manipulation of the filename parameter in the system_wl_upload_pic_file function, where an attacker can inject malicious commands that get executed by the underlying operating system. This represents a classic OS command injection vulnerability that bypasses normal input validation controls, allowing attackers to execute arbitrary code with the privileges of the web server process or root user depending on the implementation. The lack of vendor response after initial disclosure indicates a critical gap in the security supply chain and suggests that the affected device may not receive any future security patches, leaving users exposed to ongoing threats. Organizations should immediately implement network segmentation and access controls to limit exposure, while also monitoring for suspicious network traffic patterns that might indicate exploitation attempts. The vulnerability demonstrates the importance of proper input validation and secure coding practices in embedded systems, particularly those handling user-supplied data through web interfaces.