PT-2025-35137 · Comfast · Comfast Cf-N1

N0Ps1Ed · Published 2025-08-28 · Updated 2025-08-28 · CVE-2025-9585

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Comfast CF-N1 version 2.6.0

Description A vulnerability exists in Comfast CF-N1 version 2.6.0 due to command injection. Manipulation of the portal delete picname argument within the wifilith delete pic file function, located in the /usr/bin/webmgnt file, allows for remote execution of commands. The exploit for this issue has been publicly disclosed.

Recommendations Update to a newer version of Comfast CF-N1 that addresses this issue. As a temporary workaround, restrict access to the /usr/bin/webmgnt file. Avoid using the portal delete picname parameter in the wifilith delete pic file function until the issue is resolved.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2025-9585

Affected Products

Comfast Cf-N1

References · 9

• 🔥 https://github.com/ZZ2266/.github.io/blob/main/COMFAST/N1V2/wifilith_delete_pic_file/readme.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-9585 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9585 · Security Note
• https://vuldb.com/?ctiid.321698 · Note
• https://t.me/CVEtracker/31168 · Telegram Post
• https://vuldb.com/?submit.636136 · Note
• https://twitter.com/CVEnew/status/1961169500277297234 · Twitter Post
• https://vuldb.com/?id.321698 · Note
• https://t.me/cveNotify/133862 · Telegram Post