CVE Catalog
CVE-2023-38865
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk2.09%
79th percentile - higher than 79% of all known CVEs
Summary
COMFAST CF-XR11 version V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr.
Risk Assessment
This vulnerability may allow attackers to execute commands remotely on the device, posing a serious security threat to the system.
Recommendation
It is recommended to update the software to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Original NVD description (English source)
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr.