CVE-2025-9581: Comfast CF-N1 webmgnt multi_pppoe command injection

Published Aug 28, 2025

Updated

A vulnerability was detected in Comfast CF-N1 2.6.0. This impacts the function multipppoe of the file /usr/bin/webmgnt. Performing manipulation of the argument phyinterface results in command injection. The attack may be initiated remotely. The exploit is now public and may be used.

Affected Software

3 affected components

Comfast CF-N1

All of the following

Comfast Cf-n1 Firmware=2.6.0

Comfast CF-N1

Event History

Aug 28, 2025

CVE Published

via MITRE·07:02 PM

Data Sourced

via MITRE·07:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Feb 27, 57989

Event

via FIRST·11:12 PM

Frequently Asked Questions

What is the severity of CVE-2025-9581?

CVE-2025-9581 is classified as a high severity vulnerability due to the potential for remote command injection.

How do I fix CVE-2025-9581?

To fix CVE-2025-9581, update the Comfast CF-N1 firmware to the latest version that addresses this vulnerability.

What is the impact of CVE-2025-9581?

The impact of CVE-2025-9581 is that an attacker can execute arbitrary commands on the affected device remotely.

Who is affected by CVE-2025-9581?

CVE-2025-9581 affects users of Comfast CF-N1 devices running version 2.6.0.

Can CVE-2025-9581 be exploited remotely?

Yes, CVE-2025-9581 can be exploited remotely by manipulating the argument phy_interface.