CVE-2026-12814

MEDIUM

Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection

Title source: cna

Description

A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8. This issue affects the function system of the file /cgi-bin/mbox-config?section=ping_config of the component API Endpoint. This manipulation of the argument destination causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-372608 | Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection

https://vuldb.com/vuln/372608

Signature, Permissions Required signature permissions-required

VDB-372608 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/372608/cti

Third Party Advisory third-party-advisory

CVE-2026-12814 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-12814

Third Party Advisory third-party-advisory

Submit #837561 | COMFAST CF-WR631AX V3-V2.7.0.8 OS Command Injection

https://vuldb.com/submit/837561

Exploit exploit

https://github.com/0xcc12138/COMFAST-CF-WR631AX-Router-Backend-Command-Injection-RCE-Analysis-Report

View Exploit ZIP pw:eip

Scores

CVSS v3 6.3

EPSS 0.0118

EPSS Percentile 64.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-77 CWE-78

Status published

Products (9)

Comfast/CF-WR631AX V3 2.7.0.0

Comfast/CF-WR631AX V3 2.7.0.1

Comfast/CF-WR631AX V3 2.7.0.2

Comfast/CF-WR631AX V3 2.7.0.3

Comfast/CF-WR631AX V3 2.7.0.4

Comfast/CF-WR631AX V3 2.7.0.5

Comfast/CF-WR631AX V3 2.7.0.6

Comfast/CF-WR631AX V3 2.7.0.7

Comfast/CF-WR631AX V3 2.7.0.8

Published Jun 21, 2026

Tracked Since Jun 22, 2026