CVE-2026-75363 in CF-WR630AX
Summary
by MITRE • 08/26/2026
An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, display_n.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in Comfast CF-WR630AX firmware version 2.7.0.2 represents a critical remote code execution flaw rooted in insufficient input validation within the device's web management interface. This security defect allows an unauthenticated or authenticated attacker to inject and execute arbitrary system commands on the target router, effectively compromising the integrity of the network infrastructure. The attack vector targets specific binary executables and CGI scripts, namely /usr/bin/webmgnt and /cgi-bin/mbox-config, which are responsible for handling administrative configuration requests from users via HTTP interfaces.
The technical root cause lies in the improper sanitization of user-supplied input parameters, specifically timestr and display_n. These parameters are passed directly to system-level commands or shell interpreters without adequate filtering against special characters such as semicolons, ampersands, or backticks that facilitate command chaining. When an attacker crafts a malicious HTTP request containing these specially formatted payloads within the specified parameters, the underlying application processes them as executable code rather than literal string data. This lack of context-aware validation enables the injection of arbitrary shell commands into the execution flow of the vulnerable binaries.
From an operational perspective, this vulnerability poses severe risks to network security and availability. Successful exploitation grants the attacker full command-line access to the compromised device with the privileges associated with the web management service, which typically runs as root or a high-privilege user on embedded Linux systems. This level of control allows adversaries to pivot into internal networks, intercept sensitive traffic, install persistent backdoors, or use the router as part of a botnet for distributed denial-of-service attacks. The impact extends beyond individual device compromise to potential widespread network disruption and data exfiltration across connected endpoints.
This flaw aligns with Common Weakness Enumeration category CWE-78, which describes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. Furthermore, the exploitation technique corresponds to MITRE ATT&CK tactic T1059, specifically subtechnique 004 for Unix Shell Commands, where attackers leverage shell commands to execute actions on a compromised system. The attack also reflects CWE-287 regarding Improper Authentication if unauthenticated access is possible, or CWE-352 if cross-site request forgery mechanisms are bypassed due to missing anti-CSRF tokens in the affected CGI endpoints.
Mitigation strategies must prioritize immediate firmware updates provided by Comfast that address these input validation gaps. In cases where patching is not immediately feasible, network segmentation should be enforced to isolate IoT devices from critical internal assets. Additionally, disabling remote management features and restricting access to administrative interfaces via IP whitelisting can significantly reduce the attack surface. Security monitoring tools should also be configured to detect anomalous HTTP requests containing shell metacharacters directed at CGI endpoints as an indicator of potential exploitation attempts.