Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-12 | 2 | Disclosure1Patch1 |
| 2026-07-13 | 2 | PoC2 |
🚨 CVE-2026-15511 — CVSS 9.8/10 ██████████ A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/4z8nsq1I6H
Post summary
The tweet alerts users to a critical vulnerability (CVE‑2026‑15511) in Comfast CF‑WR631AX devices and urges a patch, without providing exploit details or evidence of active use.
PoC available for CVE-2026-15511: unauthenticated OS command injection in Comfast CF-WR631AX V3 routers via the system_wl_upload_pic_file function in FastCGI webmgnt. CVSS 8.9, no auth needed. 📡 https://secalerts.co/vulnerability/CVE-2026-15511?utm_campaign=x https://t.co/ynyITMgNcg
Post summary
The post announces a PoC for CVE-2026-15511, describing it as an unauthenticated OS command injection with a CVSS score of 8.9, but provides no evidence of active exploitation, patches, or false positive claims.
🚨 CRITICAL - Remote OS Command Injection in Comfast CF-WR631AX FastCGI Backend (CVE-2026-15511) Comfast CF-WR631AX V3 routers are vulnerable to OS command injection in the FastCGI backend, specifically the system_wl_upload_pic_file function inside /usr/bin/webmgnt. The root cause is improper input validation/unsafe command construction where the filename argument is not safely sanitized before being passed to system-level execution. An attacker can exploit this remotely by sending a crafted request that manipulates the filename parameter to inject shell metacharacters, and a public PoC is already available, lowering the barrier to exploitation. Successful exploitation results in arbitrary command execution on the router, enabling full device takeover, persistence, traffic interception, or pivoting deeper into the network. 👉 Affected: Comfast CF-WR631AX V3 up to 2.7.0.8 | Upgrade to No fix yet — treat as suspicious
Post summary
CVE‑2026‑15511 is a critical OS command injection on Comfast CF‑WR631AX routers, with a public PoC already released; no patch is available and there is no evidence of active exploitation at this time.
We have just added an important vulnerability affecting Comfast CF-WR631AX V3 (CVE-2026-15511) https://vuldb.com/vuln/377840
Post summary
They announced CVE-2026-15511 as a new vulnerability for the Comfast CF-WR631AX V3, with a link to the vulnerability database for further details.