Cf-xr11 Firmware vulnerabilities
6 known vulnerabilities in Cf-xr11 Firmware from Comfast. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Cf-xr11 Firmware: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt. The phy_interface parameter is not sanitized, allowing attackers to inject arbitrary commands via a
- 9.8 Critical severity
cf-xr11_firmware: Improper Neutralization of Special Elements used in a Command
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter iface.
- 9.8 Critical severity
cf-xr11: Improper Neutralization of Special Elements used in a Command
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and display_name.
- 9.8 Critical severity
cf-xr11: Improper Neutralization of Special Elements used in a Command
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webmgnt.
- 9.8 Critical severity
cf-xr11: Improper Neutralization of Special Elements used in a Command
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr.
- 9.8 Critical severity
cf-xr11: Improper Neutralization of Special Elements used in a Command
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt.