15 matches found
CVE-2026-75363
An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, displayn...
EUVD-2026-66743
An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, displayn...
PT-2026-82302
An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, display n...
CVE-2026-75363
The Comfast CF-WR630AX v.2.7.0.2 contains a vulnerability that allows a remote attacker to achieve arbitrary code execution . The flaw is accessible via the /usr/bin/webmgnt and /cgi-bin/mbox-config endpoints, specifically through the timestr and display_n parameters. Proof-of-concept (PoC) explo...
CVE-2026-75364
Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX 2024-01-30 build, the updateinterfacepng SET handler in /usr/bin/webmgnt fails to sanitize the displayname parameter. User-controlled input is concatenated via sprintf into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by...
CVE-2026-75363: Improper Neutralization of Special Elements used in an OS Command
An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, displayn...
CVE-2026-75364: Improper Neutralization of Special Elements used in an OS Command
Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX 2024-01-30 build, the updateinterfacepng SET handler in /usr/bin/webmgnt fails to sanitize the displayname parameter. User-controlled input is concatenated via sprintf into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by...
CVE-2026-75363
An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, displayn...
CVE-2026-75363
An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, displayn...
EUVD-2024-52663
Malicious code in bioql PyPI...
CVE-2024-54751
COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root...
CVE-2024-54751
COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root...
PT-2024-36415 · Comfast · Comfast Cf-Wr630Ax
Name of the Vulnerable Software and Affected Versions: COMFAST CF-WR630AX version 2.7.0.2 Description: The issue is related to a hardcoded password vulnerability in the /etc/shadow file, which allows attackers to log in as the root user. This vulnerability enables unauthorized access to the syste...