CVE-2026-15511: Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function systemwluploadpicfile of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15511?
The severity of CVE-2026-15511 is rated as critical with a score of 9.8.
What type of vulnerability is CVE-2026-15511?
CVE-2026-15511 is an OS Command Injection vulnerability found in Comfast CF-WR631AX V3.
How do I fix CVE-2026-15511?
To fix CVE-2026-15511, update the Comfast CF-WR631AX V3 firmware to the latest version available.
What effect does CVE-2026-15511 have on the system?
CVE-2026-15511 allows an attacker to execute arbitrary operating system commands on the vulnerable device.
Which software is affected by CVE-2026-15511?
CVE-2026-15511 affects the Comfast CF-WR631AX V3 and its FastCGI Backend web management system.