CVE-2026-75364: Comfast Router RCE Vulnerability

CVE-2026-75364 Overview

CVE-2026-75364 is a command injection vulnerability in Comfast CF-N1-S firmware 2.6.0.1 and the CF-WR630AX device (2024-01-30 build). The update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter before passing it to a shell command. Attacker-controlled input reaches system() through an unquoted sprintf() construction and executes with root privileges. A remote authenticated attacker can inject arbitrary shell commands and gain full control of the device.

Critical Impact
Authenticated attackers can execute arbitrary commands as root on affected Comfast wireless devices, leading to complete device compromise.

Affected Products

Comfast CF-N1-S firmware version 2.6.0.1
Comfast CF-WR630AX (2024-01-30 build)
/usr/bin/webmgnt management binary

Discovery Timeline

2026-08-26 - CVE-2026-75364 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75364

Vulnerability Analysis

The vulnerability resides in the update_interface_png SET handler exposed by the /usr/bin/webmgnt daemon. The handler accepts a display_name parameter from authenticated web management requests. Instead of validating or escaping the value, the handler concatenates it into a shell command string using sprintf(). The resulting command follows the pattern /etc/rrd/graphinterface %s %s, where the format specifiers are populated with attacker-controlled data. The daemon then passes the string to system(), which invokes /bin/sh -c with root privileges.

Because the format string uses unquoted %s substitutions, shell metacharacters such as ;, |, &&, and backticks are interpreted by the shell. This allows arbitrary command execution outside of the intended graphinterface invocation. The flaw maps to [CWE-78] (OS Command Injection).

Root Cause

The root cause is missing input sanitization on the display_name parameter combined with unsafe use of system(). The developers relied on sprintf() string formatting rather than a safe process-execution API such as execve() with argument arrays. No allow-list, escaping, or shell-quoting is applied before the shell interprets the command.

Attack Vector

A remote attacker with valid web management credentials sends a crafted request to the update_interface_png endpoint. The display_name field carries shell metacharacters followed by an arbitrary command payload. When webmgnt builds and executes the command, the injected payload runs as root. Attackers can drop persistence, extract credentials, pivot into the internal network, or brick the device.

The vulnerability requires authentication but no user interaction. Public proof-of-concept material is available in the GitHub PoC Repository.

Detection Methods for CVE-2026-75364

Indicators of Compromise

Unexpected child processes of /usr/bin/webmgnt such as sh, wget, curl, nc, or busybox invocations
HTTP requests to the update_interface_png SET handler containing shell metacharacters (;, |, `, $() in the display_name parameter
Outbound connections from the router to unknown hosts shortly after web management authentication events
Modifications to /etc/rrd/ scripts, /etc/init.d/ entries, or new cron jobs on the device

Detection Strategies

Inspect web management logs for POST requests targeting update_interface_png with non-alphanumeric characters in display_name
Enable syslog forwarding from the device and alert on system() invocations spawned by webmgnt with unusual arguments
Correlate authentication events to the router admin interface with subsequent process-creation anomalies

Monitoring Recommendations

Forward router and IoT telemetry into a centralized data lake for behavioral analysis across authentication and process events
Monitor administrative interfaces on network devices for brute-force attempts that precede authenticated exploitation
Baseline outbound traffic from management VLANs and alert on deviations that suggest reverse shells or tool download activity

How to Mitigate CVE-2026-75364

Immediate Actions Required

Restrict access to the web management interface to trusted management networks only and block WAN-side administration
Rotate administrative credentials on affected Comfast CF-N1-S and CF-WR630AX devices and enforce strong, unique passwords
Audit device configurations and firmware integrity to confirm no unauthorized changes were introduced
Segment IoT and network appliances from user and server VLANs to limit lateral movement

Patch Information

No vendor advisory or patched firmware release has been published in the referenced data at the time of writing. Monitor the Comfast support channels and the GitHub PoC Repository for updates. Replace end-of-life devices where no fix is provided.

Workarounds

Disable remote web management and require VPN access for administrative tasks
Place affected devices behind a firewall that restricts inbound access to the management port from all but explicit administrator IPs
Where feasible, replace the affected models with vendor-supported hardware that receives active security updates

bash

# Example: restrict web management to a single admin host using iptables
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP