CVE-2023-38866

2023-08-1500:00:00

mitre

www.cve.org

comfast cf-xr11 v2.7.2

command injection

function sub_415588

post request

/usr/bin/webmgnt

parameter interface

display_name

AI Score

Confidence

High

EPSS

0.012

Percentile

85.3%

JSON

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and display_name.

References

github.com/TTY-flag/my_iot_vul/tree/main/COMFAST/CF-XR11/Command_Inject2