CVE-2025-9585: Comfast CF-N1 webmgnt wifilith_delete_pic_file command injection

Published Aug 28, 2025

Updated

A vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilithdeletepicfile of the file /usr/bin/webmgnt. This manipulation of the argument portaldeletepicname causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Affected Software

3 affected components

Comfast CF-N1

All of the following

Comfast Cf-n1 Firmware=2.6.0

Comfast CF-N1=2

Event History

Aug 28, 2025

CVE Published

via MITRE·08:32 PM

Data Sourced

via MITRE·08:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Feb 28, 57989

Event

via FIRST·04:14 AM

Frequently Asked Questions

What is the severity of CVE-2025-9585?

CVE-2025-9585 is considered a high severity vulnerability due to its potential for remote command injection.

How does CVE-2025-9585 affect Comfast CF-N1 devices?

CVE-2025-9585 allows an attacker to exploit the wifilith_delete_pic_file function, leading to command injection in the affected devices.

How can I mitigate CVE-2025-9585?

Mitigation for CVE-2025-9585 involves updating the firmware of Comfast CF-N1 devices to the latest secure version.

What are the risks associated with CVE-2025-9585?

The risks of CVE-2025-9585 include unauthorized remote code execution and potential complete takeover of the affected device.

Are there any workarounds for CVE-2025-9585?

No, the recommended solution for CVE-2025-9585 is to apply the necessary firmware patch as there are no effective workarounds.