A vulnerability was determined in Comfast CF-WR631AX V3 up to 2

CVE-2026-15511 is an OS command injection (CWE-77) in the Comfast CF-WR631AX V3 WiFi 6 router, firmware ≤ 2.7.0.8. The bug lives in the webmgnt HTTP admin binary — a parameter reaching a system()-family call is concatenated into a shell string without validation, so ; whoami style payloads execute as root on the router. Sibling CVEs in the same firmware (destination in ping_config, mbox-config injection) show this is a family of bugs, not an isolated slip.

Vendor severity is CRITICAL 9.8 with vector AV:N/AC:L/PR:N/UI:N. The vector is defensible on paper — reaching the web UI is trivially network-adjacent — but the CVSS math assumes the admin interface is unauthenticated and reachable. In real deployments the admin panel is LAN-side, sometimes behind default creds, and the affected device is a $33 consumer/SMB mesh router — not a fleet asset an enterprise inventories. The 9.8 is technically accurate for the primitive; it is misleading for enterprise blast radius.

Why this verdict

• Consumer-SKU installed base: the CF-WR631AX is a sub-$40 mesh router sold via Alibaba/Sunsky — enterprise CMDBs do not carry it, so fleet exposure for a 10,000-host org is effectively zero.
• Auth is the realistic gate: the vendor-published 9.8 assumes PR:N, but the vulnerable endpoints live behind the admin login; the realistic attacker has to solve default-cred or brute force first, dropping practical CVSS to ~7.2.
• Role multiplier — low-value role (SOHO edge): chain succeeds → root on one home router → DNS hijack / botnet enrollment. Blast radius stops at the household LAN. Not identity, not hypervisor, not backup, not CI.
• Role multiplier — typical role (small retail / branch): chain succeeds → LAN pivot into a POS network is theoretically possible, but enterprises with retail footprints run managed Cisco Meraki / Fortinet / Ubiquiti, not Comfast. Population is a rounding error.
• Role multiplier — high-value role: does not exist for this SKU. There is no scenario where a domain controller, IdP, or backup server depends on a CF-WR631AX. Verdict floor is not raised.
• No KEV, no active campaign as-CVE: while Mirai variants will opportunistically absorb the PoC, there is no named campaign or CISA listing to force a KEV-style override.

Why not higher?

HIGH would require either enterprise-relevant installed base or a KEV-worthy active campaign. Neither exists: the SKU is consumer, the exploit needs auth in practice, and there is no evidence of a targeted campaign. The 9.8 vendor score is arithmetically correct for the primitive but ignores who actually buys and deploys this router.

Why not lower?

LOW / IGNORE would be wrong because the primitive is real, unauthenticated *within LAN reach* against default-credentialed units, and a sibling PoC already exists for the same webmgnt binary. Any org that has one of these in a branch office should treat it as MEDIUM and remove it, not ignore it.

1. Inventory: confirm no Comfast CF-WR631AX exists in the estate — Query CMDB, DHCP fingerprints (Comfast OUI 9C:A6:15, 44:D1:FA), and passive Zeek software.log for webmgnt User-Agent banners. If zero hits, close the ticket — no mitigation SLA applies at MEDIUM.
2. If present: disable WAN-side Remote Management immediately — The single misconfiguration that turns this from LAN-only annoyance into an internet-exposed RCE. Log into the admin UI → System → Remote Management → OFF. No mitigation SLA at MEDIUM, but do this the same day you find the device.
3. If present: rotate the admin password off the vendor default — The attack path collapses to zero without valid admin credentials. Set a 20-char random password stored in your password vault.
4. Segment the router onto an isolated VLAN with no route to production — Treat any SOHO device as untrusted infrastructure — assume it is compromised and firewall it away from corporate assets. Apply within the 365-day MEDIUM remediation window per noisgate SLA.
5. Plan hardware replacement, not patching — Comfast's patch cadence is historically poor and no fix is published. Budget replacement with managed enterprise WiFi (Meraki, Aruba, Ubiquiti UniFi) before the 365-day mark.

Run from an auditor workstation on the same LAN as the suspected router. Requires no privileges. Invoke as ./check_cf_wr631ax.sh 192.168.10.1 (replace with the router IP). Outputs VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# noisgate: CVE-2026-15511 Comfast CF-WR631AX V3 detection
# Usage: ./check_cf_wr631ax.sh <router-ip>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u
TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN: usage: $0 <router-ip>" >&2
  exit 2
fi

# 1. Is this actually a CF-WR631AX?
BANNER=$(curl -s -k --max-time 5 "http://${TARGET}/" -H 'User-Agent: noisgate/1.0' || true)
if ! echo "$BANNER" | grep -qiE 'comfast|cf-wr631ax|webmgnt'; then
  # Try the login page path
  BANNER=$(curl -s -k --max-time 5 "http://${TARGET}/cgi-bin/luci" || true)
fi
if ! echo "$BANNER" | grep -qiE 'comfast|cf-wr631ax|webmgnt'; then
  echo "UNKNOWN: target does not fingerprint as Comfast CF-WR631AX"
  exit 2
fi

# 2. Extract firmware version if exposed on the login page
FW=$(echo "$BANNER" | grep -oE '2\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)
if [[ -z "$FW" ]]; then
  # Version banner is often behind auth; flag as UNKNOWN but suspicious
  echo "UNKNOWN: Comfast device detected, firmware not exposed pre-auth; treat as VULNERABLE until proven otherwise"
  exit 2
fi

# 3. Compare against fixed threshold (<=2.7.0.8 is vulnerable; no fixed version published)
MAJOR=$(echo "$FW" | awk -F. '{print $1}')
MINOR=$(echo "$FW" | awk -F. '{print $2}')
PATCH=$(echo "$FW" | awk -F. '{print $3}')
BUILD=$(echo "$FW" | awk -F. '{print $4}')

vuln=1
if (( MAJOR > 2 )); then vuln=0
elif (( MAJOR == 2 && MINOR > 7 )); then vuln=0
elif (( MAJOR == 2 && MINOR == 7 && PATCH > 0 )); then vuln=0
elif (( MAJOR == 2 && MINOR == 7 && PATCH == 0 && BUILD > 8 )); then vuln=0
fi

if (( vuln == 1 )); then
  echo "VULNERABLE: CF-WR631AX firmware ${FW} <= 2.7.0.8 (CVE-2026-15511)"
  exit 1
else
  echo "PATCHED: CF-WR631AX firmware ${FW} > 2.7.0.8 (verify vendor advisory manually — no fix confirmed as of 2026-07-13)"
  exit 0
fi

Sources

1. Comfast CF-WR631AX sibling RCE analysis (0xcc12138)
2. VulDB CVE-2026-12814 (adjacent Comfast webmgnt injection)
3. Comfast device database
4. CISA KEV catalog
5. CWE-77: Command Injection
6. CVSS 3.1 specification (FIRST)
7. Comfast CF-WR631AX product listing (hardware context)