CVE-2023-38866
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
COMFAST CF-XR11 version V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameters interface and display_name.
Risk Assessment
This vulnerability may lead to unauthorized command execution on the device, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update the software to the latest version that addresses this vulnerability and to monitor network traffic for potential attack attempts.
Original NVD description (English source)
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter interface and display_name.