CF-WR632AX · CVE-2026-122013 · Infrastructure
NO FIX YET
VulDB reports that /usr/bin/webmgnt on Comfast CF-WR632AX 2.6.0.1 does not sanitise the filename in multipart uploads (path traversal, CWE-22). The submitter's title says unauthenticated arbitrary file write; VulDB says no authentication is required and a proof-of-concept exists. The vendor did not respond and no fix or mitigation is known. No in-the-wild exploitation is reported.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Owners of Comfast CF-WR632AX routers on firmware 2.6.0.1. VulDB (a secondary source, not the vendor) says the attack is remote and needs no authentication, via the filename field of a multipart upload handled by /usr/bin/webmgnt, so any network that can reach the admin interface is exposed. Routers whose admin interface is reachable only from a trusted LAN carry less risk. Other Comfast models and firmware builds are not named in this entry.
Not affected if admin-interface-not-reachable, other-firmware-versions
Who cares cf-wr632ax, comfast, firmware, home-network, router
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.