CVE-2026-15511

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15511", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-12T06:00:12.846Z", "datePublished": "2026-07-12T23:00:09.820Z", "dateUpdated": "2026-07-14T14:48:19.645Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-12T23:00:09.820Z"}, "title": "Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "OS Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}], "affected": [{"vendor": "Comfast", "product": "CF-WR631AX V3", "versions": [{"version": "2.7.0.0", "status": "affected"}, {"version": "2.7.0.1", "status": "affected"}, {"version": "2.7.0.2", "status": "affected"}, {"version": "2.7.0.3", "status": "affected"}, {"version": "2.7.0.4", "status": "affected"}, {"version": "2.7.0.5", "status": "affected"}, {"version": "2.7.0.6", "status": "affected"}, {"version": "2.7.0.7", "status": "affected"}, {"version": "2.7.0.8", "status": "affected"}], "cpes": ["cpe:2.3:a:comfast:cf-wr631ax_v3:*:*:*:*:*:*:*:*"], "modules": ["FastCGI Backend"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "baseSeverity": "CRITICAL"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "CRITICAL"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R", "baseSeverity": "CRITICAL"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 10, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-12T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-12T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-12T08:05:16.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "luminarydawn (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/377840", "name": "VDB-377840 | Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/377840/cti", "name": "VDB-377840 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15511", "name": "CVE-2026-15511 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/846719", "name": "Submit #846719 | Comfast (Shenzhen Four Seas Global Link Network Technology Co., CF-WR631AX V3 V2.7.0.8 OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/luminarydawn/cve/tree/main/Command%20Injection%20in%20Comfast%20CF-WR631AX%20V3%20%E2%80%94%20WiFi%20Portal%20Image%20Upload%20(CWE-78)", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T14:48:08.778045Z", "id": "CVE-2026-15511", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T14:48:19.645Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15511", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T14:48:08.778045Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T14:48:14.745Z"}}], "cna": {"title": "Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection", "credits": [{"lang": "en", "type": "reporter", "value": "luminarydawn (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 10, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:comfast:cf-wr631ax_v3:*:*:*:*:*:*:*:*"], "vendor": "Comfast", "modules": ["FastCGI Backend"], "product": "CF-WR631AX V3", "versions": [{"status": "affected", "version": "2.7.0.0"}, {"status": "affected", "version": "2.7.0.1"}, {"status": "affected", "version": "2.7.0.2"}, {"status": "affected", "version": "2.7.0.3"}, {"status": "affected", "version": "2.7.0.4"}, {"status": "affected", "version": "2.7.0.5"}, {"status": "affected", "version": "2.7.0.6"}, {"status": "affected", "version": "2.7.0.7"}, {"status": "affected", "version": "2.7.0.8"}]}], "timeline": [{"lang": "en", "time": "2026-07-12T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-12T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-12T08:05:16.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/377840", "name": "VDB-377840 | Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/377840/cti", "name": "VDB-377840 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-15511", "name": "CVE-2026-15511 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/846719", "name": "Submit #846719 | Comfast (Shenzhen Four Seas Global Link Network Technology Co., CF-WR631AX V3 V2.7.0.8 OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/luminarydawn/cve/tree/main/Command%20Injection%20in%20Comfast%20CF-WR631AX%20V3%20%E2%80%94%20WiFi%20Portal%20Image%20Upload%20(CWE-78)", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "OS Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-12T23:00:09.820Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15511", "state": "PUBLISHED", "dateUpdated": "2026-07-14T14:48:19.645Z", "dateReserved": "2026-07-12T06:00:12.846Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-12T23:00:09.820Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:comfast:cf-wr631ax_v3:*:*:*:*:*:*:*:*"], "modules": ["FastCGI Backend"], "product": "CF-WR631AX V3", "vendor": "Comfast", "versions": [{"status": "affected", "version": "2.7.0.0"}, {"status": "affected", "version": "2.7.0.1"}, {"status": "affected", "version": "2.7.0.2"}, {"status": "affected", "version": "2.7.0.3"}, {"status": "affected", "version": "2.7.0.4"}, {"status": "affected", "version": "2.7.0.5"}, {"status": "affected", "version": "2.7.0.6"}, {"status": "affected", "version": "2.7.0.7"}, {"status": "affected", "version": "2.7.0.8"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en Comfast CF-WR631AX V3 hasta la versi\u00f3n 2.7.0.8. Esta vulnerabilidad afecta a la funci\u00f3n system_wl_upload_pic_file del archivo /usr/bin/webmgnt del componente FastCGI Backend. Esta manipulaci\u00f3n del argumento filename provoca inyecci\u00f3n de comandos del sistema operativo. Es posible iniciar el ataque de forma remota. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-15511", "lastModified": "2026-10-24T22:10:00.210", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15511", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T14:48:08.778045Z", "version": "2.0.3"}}]}, "published": "2026-07-12T23:16:38.137", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/luminarydawn/cve/tree/main/Command%20Injection%20in%20Comfast%20CF-WR631AX%20V3%20%E2%80%94%20WiFi%20Portal%20Image%20Upload%20(CWE-78)"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-15511"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/846719"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/377840"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/377840/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.7.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.7.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.7.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.7.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.7.0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.7.0.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.7.0.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.7.0.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.7.0.8"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "CF-WR631AX V3", "source": "cna", "vendor": "Comfast"}, "product": "cf-wr631ax_v3", "vendor": "comfast"}], "created": "2026-07-13T02:15:04.680774+00:00", "updated": "2026-08-24T16:30:07.325471+00:00", "vendors": ["comfast", "comfast$PRODUCT$cf-wr631ax_v3"]}