CVE-2025-9583: Comfast CF-N1 webmgnt ping_config command injection

Published Aug 28, 2025

Updated

A vulnerability has been found in Comfast CF-N1 2.6.0. Affected by this vulnerability is the function pingconfig of the file /usr/bin/webmgnt. The manipulation leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

Affected Software

3 affected components

Comfast CF-N1

All of the following

Comfast Cf-n1 Firmware=2.6.0

Comfast CF-N1=2

Event History

Aug 28, 2025

CVE Published

via MITRE·08:02 PM

Data Sourced

via MITRE·08:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Feb 28, 57989

Event

via FIRST·07:48 AM

Frequently Asked Questions

What is the severity of CVE-2025-9583?

CVE-2025-9583 is classified as a high-severity vulnerability due to the potential for remote command injection.

How do I fix CVE-2025-9583?

To remediate CVE-2025-9583, update your Comfast CF-N1 device to the latest firmware version that addresses this vulnerability.

What systems are affected by CVE-2025-9583?

CVE-2025-9583 affects Comfast CF-N1 devices running version 2.6.0.

Can CVE-2025-9583 be exploited remotely?

Yes, CVE-2025-9583 can be exploited remotely, allowing attackers to execute arbitrary commands.

What type of vulnerability is CVE-2025-9583?

CVE-2025-9583 is a command injection vulnerability found in the ping_config function.