| शीर्षक | Comfast (Shenzhen Four Seas Global Link Network Technology Co., CF-WR631AX V3 V2.7.0.8 OS Command Injection |
|---|
| विवरण | The Comfast CF-WR631AX V3 firmware V2.7.0.8 contains an unauthenticated OS command
injection vulnerability in the web management FastCGI backend (/usr/bin/webmgnt).
The system_wl_upload_pic_file handler (used for WiFi Portal image uploads) extracts
a user-supplied filename from the JSON POST body, splices it directly into a shell
command via sprintf(), and executes it through system() as root. No input validation,
character filtering, or shell escaping is performed at any point in the chain.
Attackers on the LAN (or WAN if remote management is exposed) can send a crafted HTTP
POST request with shell metacharacters in the filename field to execute arbitrary
commands with root privileges. |
|---|
| स्रोत | ⚠️ https://github.com/luminarydawn/cve/tree/main/Command%20Injection%20in%20Comfast%20CF-WR631AX%20V3%20%E2%80%94%20WiFi%20Portal%20Image%20Upload%20(CWE-78) |
|---|
| उपयोगकर्ता | luminarydawn (UID 98723) |
|---|
| सबमिशन | 03/06/2026 07:19 AM (1 महीना पहले) |
|---|
| संयम | 12/07/2026 08:00 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 377840 [Comfast CF-WR631AX V3 तक 2.7.0.8 FastCGI Backend /usr/bin/webmgnt system_wl_upload_pic_file filename अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|