{"id":"CVE-2026-122013","kind":"vulnerability","aliases":["CVE-2026-122013"],"related":[],"title":"Comfast CF-WR632AX router: remote path traversal via multipart upload filename","description":"A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"VulDB reports that /usr/bin/webmgnt on Comfast CF-WR632AX 2.6.0.1 does not sanitise the filename in multipart uploads (path traversal, CWE-22). The submitter's title says unauthenticated arbitrary file write; VulDB says no authentication is required and a proof-of-concept exists. The vendor did not respond and no fix or mitigation is known. No in-the-wild exploitation is reported.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CF-WR632AX","fixed":[],"affected":"2.6.0.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["cf-wr632ax","comfast","firmware","home-network","infrastructure","router"],"not_affected_if":["admin-interface-not-reachable","other-firmware-versions"],"how_to_check":"- Log in to the router admin page and read the firmware version; 2.6.0.1 is the only version named as affected (other builds are untested, not confirmed safe)\n- Check whether the web management interface (nginx/webmgnt) answers from the WAN side or from untrusted networks; VulDB says no authentication is needed, so any network that can reach it can attack it\n- No vendor fix or countermeasure is known: restrict admin access to a trusted LAN, disable remote management, or replace the device","fix":null,"status":"open","published_at":"2026-11-04T21:18:07+00:00","first_seen_at":"2026-11-04T21:49:18+00:00","triaged_at":"2026-11-04T21:50:31+00:00","updated_at":"2026-11-04T21:51:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T21:50:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Comfast CF-WR632AX router: remote path traversal via multipart upload filename","impact":"high","summary":"The Comfast CF-WR632AX 2.6.0.1 router firmware's web management binary /usr/bin/webmgnt mishandles the filename argument in multipart uploads, allowing path traversal. A remote attacker can use the public exploit to write or access files outside the intended directory on the device.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["comfast","cf-wr632ax","router","firmware","home-network"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads or writes arbitrary files on the router","analyst_note":"Check whether authentication is required for the multipart upload endpoint and whether any vendor firmware fix exists; the NVD entry is the only source.","how_to_check":"- Check the firmware version on the device admin page; unknown whether `2.6.0.1` is the only affected build\n- Confirm whether the web management interface is reachable from the internet\n- unknown for any other check, as the sources do not say","plain_action":"If you own a Comfast CF-WR632AX router, restrict its admin interface from the internet and watch for a firmware update from Comfast; the vendor has not responded to the disclosure.","needs_analyst":true,"not_affected_if":["admin-interface-not-reachable","other-firmware-versions"],"who_is_affected":"Owners of Comfast CF-WR632AX routers running firmware 2.6.0.1 whose web management interface is reachable over the network. The flaw is in the multipart parser of the web management binary, so exposure depends on whether that interface accepts requests from the attacker's network. Devices where the admin interface is only reachable on a trusted LAN carry less risk, but the sources do not say how the interface is exposed by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000764,"input_tokens":4165,"output_tokens":694,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check whether authentication is required for the multipart upload endpoint and whether any vendor firmware fix exists; the NVD entry is the only source.","search":"'-122013':15A,18A '-2026':14A,17A '-22':53B '/usr/bin/webmgnt':35B,117C '2.6.0.1':41B,105C 'affect':106C 'arbitrari':60B 'argument':128C 'attack':140C 'authent':66B 'cf':3A,20A,23B,39B,103C 'cf-wr632ax':2A,19A,22B,38B,102C 'comfast':1A,25B,37B,101C 'compon':120C 'concept':74B 'contact':154C 'cve':13A,16A 'cwe':52B 'detect':99C 'disclosur':158C 'earli':155C 'exist':75B 'exploit':93B,143C 'file':61B,116C 'filenam':12A,46B,129C 'firmwar':26B 'fix':83B 'function':113C 'home':28B 'home-network':27B 'in-the-wild':89B 'infrastructur':30B 'initi':138C 'known':87B 'manipul':125C 'may':148C 'mitig':85B 'multipart':10A,48B,121C 'network':29B 'parser':122C 'path':7A,50B,132C 'perform':123C 'possibl':136C 'proof':72B 'proof-of-concept':71B 'public':146C 'remot':6A,141C 'report':33B,95B 'requir':68B 'respond':80B,162C 'result':130C 'router':5A,31B 'sanitis':44B 'say':58B,64B 'submitt':55B 'titl':57B 'travers':8A,51B,133C 'unauthent':59B 'unknown':112C 'upload':11A,49B 'use':150C 'vendor':77B,152C 'via':9A 'vuldb':32B,63B 'vulner':97C,109C 'way':165C 'wild':92B 'wr632ax':4A,21A,24B,40B,104C 'write':62B","nicknames":[],"mitigations":[],"who_affected":"Owners of Comfast CF-WR632AX routers on firmware 2.6.0.1. VulDB (a secondary source, not the vendor) says the attack is remote and needs no authentication, via the filename field of a multipart upload handled by /usr/bin/webmgnt, so any network that can reach the admin interface is exposed. Routers whose admin interface is reachable only from a trusted LAN carry less risk. Other Comfast models and firmware builds are not named in this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you own a Comfast CF-WR632AX router, turn off remote (internet) access to its admin page and watch for a firmware update from Comfast; the vendor has not responded, so consider replacing the router if it must be reachable from the internet.","pkeys":["cfwr632ax"],"ptokens":["cf","wr632ax"],"labels":["cfwr632ax","comfast","critical","firmware","homenetwork","infrastructure","router"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122013","severity":null,"published_at":"2026-11-04T21:18:07+00:00","modified_at":"2026-11-04T21:18:07+00:00","first_seen_at":"2026-11-04T21:49:18+00:00","fetched_at":"2026-11-04T21:49:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122013:1709","url":"https://vuldb.com/vuln/431080","severity":null,"published_at":"2026-11-04T21:51:25+00:00","modified_at":"2026-11-04T21:51:25+00:00","first_seen_at":"2026-11-04T21:51:25+00:00","fetched_at":"2026-11-04T21:51:25+00:00","note":"Only VulDB (CNA) and NVD found; no vendor page, so nothing verified. VulDB: unauthenticated, PoC public (github link hidden behind paywall), vendor silent, no countermeasure. Not checked: X (skipped), PoC repo not located.","cites":["https://vuldb.com/vuln/431080","https://nvd.nist.gov/vuln/detail/CVE-2026-122013"]}],"documents":[{"id":70871,"url":"https://vuldb.com/vuln/431080","title":"VulDB VDB-431080: Comfast CF-WR632AX 2.6.0.1 webmgnt filename path traversal","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":70872,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122013","title":"NVD CVE-2026-122013","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}