CVE-2025-9582: Comfast CF-N1 webmgnt ntp_timezone command injection

Published Aug 28, 2025

Updated

A flaw has been found in Comfast CF-N1 2.6.0. Affected is the function ntptimezone of the file /usr/bin/webmgnt. Executing manipulation of the argument timestr can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used.

Affected Software

3 affected components

Comfast CF-N1

All of the following

Comfast Cf-n1 Firmware=2.6.0

Comfast CF-N1

Event History

Aug 28, 2025

CVE Published

via MITRE·07:32 PM

Data Sourced

via MITRE·07:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Feb 28, 57989

Event

via FIRST·06:58 AM

Frequently Asked Questions

What is the severity of CVE-2025-9582?

CVE-2025-9582 is considered a high severity vulnerability due to its potential for remote command injection.

How do I fix CVE-2025-9582?

To fix CVE-2025-9582, update to the latest firmware version for the Comfast CF-N1 that addresses this vulnerability.

What is the impact of CVE-2025-9582?

The impact of CVE-2025-9582 allows attackers to execute arbitrary commands on the affected device through manipulated inputs.

Can CVE-2025-9582 be exploited remotely?

Yes, CVE-2025-9582 can be exploited remotely, allowing attackers to gain unauthorized control over the device.

Which version of Comfast CF-N1 is affected by CVE-2025-9582?

Comfast CF-N1 version 2.6.0 is affected by CVE-2025-9582 and is vulnerable to command injection.