cbcvebase.
CVE-2025-9586
published 2025-08-28

CVE-2025-9586: A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such…

PriorityP269high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
8.32%
94.2th percentile
A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipulation of the argument mac leads to command injection. The attack may be performed from a remote location. The exploit is publicly available and might be used.

Affected

2 ranges
VendorProductVersion rangeFixed in
comfastcf-n1——
comfastcf-n1_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/cgi-bin/mbox-config
path/usr/bin/webmgnt↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS ComFast mbox-config wireless_device_dissoc mac Parameter Command Injection Attempt (CVE-2025-9586)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/mbox-config|3f|"; fast_pattern; startswith; content:"method|3d|SET"; content:"section|3d|wireless_device_dissoc"; http.request_body; content:"|22|mac|22|"; pcre:"/^(?:\x3a(?:\x20\x22|\x22))?[^\x2c\x7d$]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,github.com/jinhao118/cve/blob/main/ComFast%20CF-AC100-V2.6.0.8_3.md; reference:cve,2025-9586; classtype:attempted-admin; sid:2068154; rev:1; metadata:affected_product ComFast, attack_target Networking_Equipment, tls_state plaintext, created_at 2026_03_11, cve CVE_2025_9586, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_03_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Exploit targets HTTP POST requests to /cgi-bin/mbox-config with query string delimiter (URL-encoded '?'), setting method=SET and section=wireless_device_dissoc, with the 'mac' parameter in the request body containing shell injection characters.
  • →The PCRE pattern matches injection payloads in the mac parameter body value containing shell metacharacters: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24), optionally URL-encoded.
  • →Attack is remotely exploitable, plaintext (non-TLS) traffic only, and the exploit is publicly available — prioritize perimeter and internal network monitoring.
  • →Vulnerable function is wireless_device_dissoc in /usr/bin/webmgnt on Comfast CF-N1 2.6.0; command injection occurs via unsanitized 'mac' argument. ↗
  • ·Snort/Suricata SID 2068154 is scoped to plaintext HTTP only (tls_state plaintext); encrypted HTTPS traffic to the CGI endpoint will NOT be detected by this rule.
  • ·The ET rule targets $HOME_NET as the destination, meaning it is designed for perimeter/internal deployment where the vulnerable Comfast device is inside the monitored network segment.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.