Comfast

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 10.0CriticalNov 4, 2026Comfast CF-WR632AX Path traversal / file handlingCVE-2026-122013A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
• 10.0CriticalSep 20, 2026Comfast CF-N1-S Memory corruptionCVE-2026-94003A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
• 9.8CriticalJul 12, 2026Comfast CF-WR631AX V3 Code / command injectionCVE-2026-15511A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.4.7% likely
• 4.7MediumMar 9, 2026Comfast cf-ac100 firmware Code / command injectionCVE-2026-3798A vulnerability was detected in Comfast CF-AC100 2.6.0.8. This affects the function sub_44AC14 of the file /cgi-bin/mbox-config?method=SET&section=ping_config of the component Request Path Handler. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.17% likelyDetection
• 6.3MediumFeb 20, 2026Comfast cf-e7 firmware Code / command injectionCVE-2026-2824A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub_441CF4 of the file /cgi-bin/mbox-config?method=SET&section=ping_config of the component webmggnt. Executing a manipulation of the argument destination can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.17% likelyDetection
• 6.3MediumFeb 20, 2026Comfast cf-e7 firmware Code / command injectionCVE-2026-2823A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component webmggnt. Performing a manipulation of the argument timestr results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.19% likelyDetection
• 4.7MediumFeb 16, 2026Comfast cf-e4 firmware Code / command injectionCVE-2026-2537A vulnerability was identified in Comfast CF-E4 2.6.0.1. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component HTTP POST Request Handler. Such manipulation of the argument timestr leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.28% likelyDetection
• 6.3MediumFeb 16, 2026Comfast cf-n1 firmware Code / command injectionCVE-2026-2535A vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub_44AB9C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel. The manipulation of the argument channel results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.16% likelyDetection
• 6.3MediumFeb 16, 2026Comfast cf-n1 firmware Code / command injectionCVE-2026-2534A vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=SET&section=ptest_bandwidth. The manipulation of the argument bandwidth leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.15% likelyDetection
• 8.8HighSep 18, 2025Comfast cf-xr11 firmware Code / command injectionCVE-2025-57293A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt. The phy_interface parameter is not sanitized, allowing attackers to inject arbitrary commands via a POST request to /cgi-bin/mbox-config?method=SET&section=multi_pppoe. When the action parameter is set to "one_click_redial", the unsanitized phy_interface is used in a system() call, enabling execution of malicious commands. This can lead t1.7% likely

See every Comfast entry on the dashboard.

Top products

• cf-n1 firmware2 CVEs in the last year
• cf-e7 firmware2 CVEs in the last year
• CF-WR632AX1 CVE in the last year, 1 critical
• CF-WR631AX V31 CVE in the last year, 1 critical
• CF-N1-S1 CVE in the last year, 1 critical
• cf-e4 firmware1 CVE in the last year
• cf-ac100 firmware1 CVE in the last year