PatchSiren cyber security CVE debrief
CVE-2026-12814 Comfast CVE debrief
CVE-2026-12814 is a low-severity command injection vulnerability in Comfast CF-WR631AX V3 routers up to version 2.7.0.8. The vulnerability affects the /cgi-bin/mbox-config?section=ping_config API endpoint, allowing remote attackers to inject OS commands via the 'destination' argument. The CVSS score is 2.1, indicating a low severity. The exploit has been published, but the vendor did not respond to the disclosure. Defenders should assess their exposure and prioritize patching due to the remote attack vector.
- Vendor
- Comfast
- Product
- CF-WR631AX V3
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-21
- Original CVE updated
- 2026-06-22
- Advisory published
- 2026-06-21
- Advisory updated
- 2026-06-22
Who should care
Organizations using Comfast CF-WR631AX V3 routers up to version 2.7.0.8 should prioritize patching this vulnerability. The remote attack vector and published exploit increase the urgency for defenders to limit exposure. Security teams responsible for network devices, especially those with internet-facing interfaces, should assess and mitigate this risk.
Technical summary
The vulnerability (CVE-2026-12814) is caused by improper input validation in the /cgi-bin/mbox-config?section=ping_config API endpoint of Comfast CF-WR631AX V3 routers. Specifically, the 'destination' argument is vulnerable to OS command injection. This allows remote attackers with low privileges to execute arbitrary commands on the system. The vulnerability's CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X, indicating a low severity score of 2.1.
Defensive priority
Low severity but high urgency due to published exploit and remote attack vector.
Recommended defensive actions
- Inventory Comfast CF-WR631AX V3 routers and verify versions up to 2.7.0.8.
- Review and apply vendor patches or updates if available.
- Implement compensating controls such as restricting access to the /cgi-bin/mbox-config API.
- Monitor network traffic for suspicious activity related to the affected API.
- Track exceptions for any necessary business continuity.
Evidence notes
The primary evidence for this vulnerability comes from the CVE record and NVD detail pages. The affected product is Comfast CF-WR631AX V3 up to version 2.7.0.8. The vulnerability affects the /cgi-bin/mbox-config?section=ping_config API endpoint. Defenders should verify the CVSS score of 2.1 and the remote attack vector from official sources.
Official resources
This article is AI-assisted and based on the supplied source corpus.