CVE-2026-12814: Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection
A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8. This issue affects the function system of the file /cgi-bin/mbox-config?section=pingconfig of the component API Endpoint. This manipulation of the argument destination causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
At the network perimeter or via a WAF/ACL, block or restrict access to the vulnerable API endpoint /cgi-bin/mbox-config?section=ping_config (mbox-config system function) on Comfast CF-WR631AX V3 devices. Allow access only from trusted administrative IPs or internal management networks.
- Operational
Search device and network logs for requests to /cgi-bin/mbox-config?section=ping_config and indicators of command injection activity. If exploitation is detected, isolate the affected Comfast CF-WR631AX V3 device(s) from the network and perform incident response procedures.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12814?
The severity of CVE-2026-12814 is medium with a CVSS score of 6.3.
How do I fix CVE-2026-12814?
To fix CVE-2026-12814, update the Comfast CF-WR631AX V3 to the latest version past 2.7.0.8.
What type of vulnerability is CVE-2026-12814?
CVE-2026-12814 is an OS command injection vulnerability affecting the API Endpoint of the device.
What component is affected by CVE-2026-12814?
CVE-2026-12814 affects the system function of the /cgi-bin/mbox-config?section=ping_config API Endpoint.
Can CVE-2026-12814 be exploited remotely?
Yes, CVE-2026-12814 can be exploited remotely due to its network access vector.