Comfast CF-WR632AX Multipart webmgnt path traversal

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• vuldb.com/cve/CVE-2026-122013 Üçüncü taraf
• vuldb.com/submit/1023251 Üçüncü taraf
• github.com/FoundTL/COMFAST-CF-WR632AX-Wi-Fi-6-Router İstismar kodu ya da analiz
• vuldb.com/vuln/431080 Diğer
• vuldb.com/vuln/431080/cti Diğer

Kayıt geçmişi

1. 4 Kas 2026 23:45Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-57565Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)
• 8,6 CVE-2026-57567Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview
• 6,2 CVE-2026-58128Alan: Health Insurance for Android 1.450.0 Path Traversal via ShareReceiverActivity
• 6,5 CVE-2026-16725IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangSmith
• 6,3 CVE-2026-76806Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle
• 7,6 CVE-2026-76506Cisco Unified Computing System Central Remote Code Execution Vulnerability