PT-2026-57563 · Comfast · Cf-Wr631Ax V3

Luminarydawn · Published 2026-07-12 · Updated 2026-07-12 · CVE-2026-15511

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Comfast CF-WR631AX V3 versions prior to 2.7.0.8

Description An OS command injection flaw exists in the FastCGI Backend component within the /usr/bin/webmgnt file. The issue occurs in the system wl upload pic file() function when processing the filename argument, allowing a remote attacker to execute arbitrary operating system commands.

Recommendations Update Comfast CF-WR631AX V3 to a version newer than 2.7.0.8. As a temporary mitigation, restrict access to the system wl upload pic file() function within the FastCGI Backend component.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-15511

Affected Products

Cf-Wr631Ax V3

References · 7

• 🔥 https://github.com/luminarydawn/cve/tree/main/Command%20Injection%20in%20Comfast%20CF-WR631AX%20V3%20%E2%80%94%20WiFi%20Portal%20Image%20Upload%20(CWE-78) · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-15511 · Security Note
• https://twitter.com/vuldb/status/2076251655608422451 · Twitter Post
• https://vuldb.com/vuln/377840/cti · Note
• https://vuldb.com/cve/CVE-2026-15511 · Note
• https://vuldb.com/vuln/377840 · Note
• https://vuldb.com/submit/846719 · Note