CVE-2026-15511 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-15511 | CVSS 9.8 (Critical) | Exploit: PoC available

What Is It

CVE-2026-15511 is an OS command injection vulnerability in the Comfast CF-WR631AX V3 wireless router (firmware versions up to 2.7.0.8), specifically within the system_wl_upload_pic_file function of the /usr/bin/webmgnt FastCGI backend component.

Technical Detail

The flaw exists in how the system_wl_upload_pic_file function processes the filename argument passed through the FastCGI backend, failing to sanitize user-supplied input before passing it to a system-level call. An unauthenticated or authenticated remote attacker can craft a malicious filename value to inject arbitrary OS commands, which will be executed with the privileges of the web management process. Successful exploitation results in remote code execution on the underlying device, giving an attacker full control over the router including network traffic interception, configuration modification, and use of the device as a pivot point.

Exploitation Status

A public proof-of-concept exploit has been disclosed. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed in-the-wild exploitation has been reported as of July 13, 2026. However, the public availability of a PoC lowers the barrier for exploitation and increases the likelihood of opportunistic attacks in the near term.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability. Given the device class (consumer and small business wireless routers) and the nature of the flaw, opportunistic actors targeting exposed network edge devices are a plausible risk profile, but no attribution is supported by current data.

What To Do

No patch or firmware update has been confirmed as available from Comfast at this time; the vendor did not respond to disclosure contact. Organizations and individuals operating the CF-WR631AX V3 should immediately restrict management interface access by disabling remote web management and ensuring the device's administrative interface is not exposed to untrusted networks or the public internet. Network segmentation should be applied to isolate the device from sensitive internal systems. Monitor for anomalous outbound connections or unexpected configuration changes originating from the device. If no vendor patch is released in a reasonable timeframe, replacement with a supported device from a responsive vendor should be evaluated.