Comfast CF-WR631AX V3 webmgnt OS command injection (root RCE)

#!/usr/bin/env bash
# noisgate: CVE-2026-15511 Comfast CF-WR631AX V3 detection
# Usage: ./check_cf_wr631ax.sh <router-ip>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u
TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN: usage: $0 <router-ip>" >&2
  exit 2
fi

# 1. Is this actually a CF-WR631AX?
BANNER=$(curl -s -k --max-time 5 "http://${TARGET}/" -H 'User-Agent: noisgate/1.0' || true)
if ! echo "$BANNER" | grep -qiE 'comfast|cf-wr631ax|webmgnt'; then
  # Try the login page path
  BANNER=$(curl -s -k --max-time 5 "http://${TARGET}/cgi-bin/luci" || true)
fi
if ! echo "$BANNER" | grep -qiE 'comfast|cf-wr631ax|webmgnt'; then
  echo "UNKNOWN: target does not fingerprint as Comfast CF-WR631AX"
  exit 2
fi

# 2. Extract firmware version if exposed on the login page
FW=$(echo "$BANNER" | grep -oE '2\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)
if [[ -z "$FW" ]]; then
  # Version banner is often behind auth; flag as UNKNOWN but suspicious
  echo "UNKNOWN: Comfast device detected, firmware not exposed pre-auth; treat as VULNERABLE until proven otherwise"
  exit 2
fi

# 3. Compare against fixed threshold (<=2.7.0.8 is vulnerable; no fixed version published)
MAJOR=$(echo "$FW" | awk -F. '{print $1}')
MINOR=$(echo "$FW" | awk -F. '{print $2}')
PATCH=$(echo "$FW" | awk -F. '{print $3}')
BUILD=$(echo "$FW" | awk -F. '{print $4}')

vuln=1
if (( MAJOR > 2 )); then vuln=0
elif (( MAJOR == 2 && MINOR > 7 )); then vuln=0
elif (( MAJOR == 2 && MINOR == 7 && PATCH > 0 )); then vuln=0
elif (( MAJOR == 2 && MINOR == 7 && PATCH == 0 && BUILD > 8 )); then vuln=0
fi

if (( vuln == 1 )); then
  echo "VULNERABLE: CF-WR631AX firmware ${FW} <= 2.7.0.8 (CVE-2026-15511)"
  exit 1
else
  echo "PATCHED: CF-WR631AX firmware ${FW} > 2.7.0.8 (verify vendor advisory manually — no fix confirmed as of 2026-07-13)"
  exit 0
fi