Comfast vulnerabilities
We track 29 vulnerabilities in Comfast products across 15 products. 29 are rated high or critical, and none are known to be exploited. The most recent was published on November 4, 2026.
Latest Comfast vulnerabilities
- 10.0 Critical severity
CF-WR632AX: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal.
- 10.0 Critical severity
CF-N1-S: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initi
- 9.9 Critical severity
CF-N1-S: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component Web Management. The manipulation of the argument timestr/ntp_client_enabled
- 9.9 Critical severity
CF-N1-S: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack ca
- 9.9 Critical severity
CF-N1-S: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack ca
- 9.9 Critical severity
CF-N1-S: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_ssid of the component SSID Configuration. The manipulation of the argument ssid results
- 7.4 High severity
CF-N1-S: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET§ion=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. Th
- 10.0 Critical severity
CF-N1-S: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack
- 9.1 Critical severity
CF-N1-S: Improper Neutralization of Special Elements used in a Command
A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exp
- 9.8 Critical severity
CF-WR631AX V3: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os
- 7.2 High severity
CF-AC100: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in Comfast CF-AC100 2.6.0.8. This affects the function sub_44AC14 of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the component Request Path Handler. The manipulation results in command injection. The attack may
- 8.8 High severity
CF-E7: Improper Neutralization of Special Elements used in a Command
A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub_441CF4 of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the component webmggnt. Executing a manipulation of the argument destination can lead to command injection.
- 8.8 High severity
CF-E7: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component webmggnt. Performing a manipulation of the argument timestr results in comm
- 7.2 High severity
CF-E4: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in Comfast CF-E4 2.6.0.1. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component HTTP POST Request Handler. Such manipulation of the argument timestr leads to command in
- 8.8 High severity
CF-N1 V2: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub_44AB9C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel. The manipulation of the argument channel results in command injection. The attack can be l
- 8.8 High severity
CF-N1 V2: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_bandwidth. The manipulation of the argument bandwidth leads to command injection. The attack c
- 8.8 High severity
Cf-xr11 Firmware: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt. The phy_interface parameter is not sanitized, allowing attackers to inject arbitrary commands via a
- 8.8 High severity
CF-N1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipulation of the argument mac leads to command injection. The attack may be performed from a remote loca
- 8.8 High severity
CF-N1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This manipulation of the argument portal_delete_picname causes command injection. The attack is possible to be carried out r
- 8.8 High severity
CF-N1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Comfast CF-N1 2.6.0. Affected by this issue is the function update_interface_png of the file /usr/bin/webmgnt. The manipulation of the argument interface/display_name results in command injection. The attack can be executed remotel
- 8.8 High severity
CF-N1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Comfast CF-N1 2.6.0. Affected by this vulnerability is the function ping_config of the file /usr/bin/webmgnt. The manipulation leads to command injection. Remote exploitation of the attack is possible. The exploit has been dis
- 9.8 Critical severity
CF-N1: Improper Neutralization of Special Elements used in a Command
A flaw has been found in Comfast CF-N1 2.6.0. Affected is the function ntp_timezone of the file /usr/bin/webmgnt. Executing manipulation of the argument timestr can lead to command injection. The attack may be launched remotely. The exploit has been published
- 9.8 Critical severity
CF-N1: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in Comfast CF-N1 2.6.0. This impacts the function multi_pppoe of the file /usr/bin/webmgnt. Performing manipulation of the argument phy_interface results in command injection. The attack may be initiated remotely. The exploit is no
- 9.8 Critical severity
cf-xr11_firmware: Improper Neutralization of Special Elements used in a Command
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter iface.
- 9.8 Critical severity
cf-xr11: Improper Neutralization of Special Elements used in a Command
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and display_name.
- 9.8 Critical severity
cf-xr11: Improper Neutralization of Special Elements used in a Command
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webmgnt.
- 9.8 Critical severity
cf-xr11: Improper Neutralization of Special Elements used in a Command
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr.
- 9.8 Critical severity
cf-xr11: Improper Neutralization of Special Elements used in a Command
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt.
- 8.8 High severity
Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the…
Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the target via an HTTP POST request