CVE-2026-122013: Critical Comfast Router Flaw

Are You Affected?

CVE-2026-122013 affects the Comfast CF-WR632AX Wi-Fi 6 router. The affected firmware version explicitly identified in the available NVD-derived information is 2.6.0.1. No broader affected-version range has been established, and no fixed firmware version has been identified.

The vulnerable functionality is associated with the router’s web-management service and the multipart filename parameter. The available record does not establish whether the service requires authentication, whether every firmware build exposes the same endpoint, or whether versions newer than 2.6.0.1 are affected. Administrators should therefore treat 2.6.0.1 as vulnerable and verify any later firmware directly with Comfast before considering it remediated.

A router is especially exposed when its administration interface is reachable from the Internet, an untrusted wireless network, a guest network, or a shared upstream environment. Devices behind carrier-grade NAT or a firewall are not automatically safe. An attacker on the local network may still be able to reach management services.

Analyst’s Take: Treat 2.6.0.1 as vulnerable until Comfast confirms otherwise. The first priority is management-interface isolation, not changing the port or waiting for evidence of active exploitation.

The Fix, If You’re in a Hurry

No verified vendor-fixed version was identified in the available sources. The vendor was reportedly contacted before disclosure but did not respond. Consequently, there is no defensible upgrade target to quote beyond the requirement to install a Comfast firmware release that explicitly addresses CVE-2026-122013, if one becomes available.

Until a fix is confirmed:

1. Disable remote administration.
2. Restrict the management interface to a dedicated administration VLAN or trusted source addresses.
3. Block inbound access to management ports at the network perimeter.
4. Verify whether firmware 2.6.0.1 is installed.
5. Monitor Comfast’s official support channels for a confirmed fix.
6. Replace the router if it cannot be isolated or maintained.

Changing the management port does not provide meaningful protection on its own.

For broader incident-response planning, see how to write an incident response plan.

Technical Notes: Immediate Mitigation

The exact management port and firmware upgrade mechanism were not provided in the retrieved record, so administrators should identify them from the device configuration rather than applying an unverified command. A generic perimeter rule should deny inbound access to the router’s management address and permit administration only from an approved network:

Internet/untrusted networks  ->  router management interface: DENY
Management VLAN               ->  router management interface: ALLOW
Trusted administrator hosts   ->  router management interface: ALLOW

For a Linux-based firewall protecting the management network, an example policy pattern is:

# Replace the values with the actual management host, port, and admin subnet.
sudo nft add rule inet filter input ip saddr != 192.0.2.0/24 \
    ip daddr 192.0.2.1 tcp dport 80 drop
sudo nft add rule inet filter input ip saddr != 192.0.2.0/24 \
    ip daddr 192.0.2.1 tcp dport 443 drop

This is a containment example, not a vendor-specific remediation command. Before deployment, confirm the router address, ports, firewall path, and management subnet. If Comfast publishes a corrected image, download it only from an authenticated vendor source, verify its release notes and integrity information, back up configuration safely, and upgrade through the supported device process.

If no supported fix is released, replacement with a maintained router is the most reliable long-term mitigation. Organizations replacing vulnerable network equipment should also review endpoint protection options such as Malwarebytes for systems that may have interacted with an exposed device.

How This Vulnerability Works

The vulnerability is in the Multipart Parser functionality of /usr/bin/webmgnt. According to the available description, manipulating the multipart filename argument causes path traversal. A multipart request is commonly used for web uploads or form submissions; the filename field identifies the client-supplied name of an uploaded object.

The security failure occurs when application logic uses that attacker-controlled name in filesystem operations without adequately constraining it to the intended directory. Traversal sequences such as ../ can cause a path to resolve outside the expected upload location. The retrieved information does not establish the exact vulnerable function, normalization behavior, filesystem permissions, endpoint, or whether the operation supports reading, writing, or both.

A simplified unsafe pattern would look like this:

// Illustrative pseudocode only; not a reconstruction of Comfast code.
snprintf(path, sizeof(path), "/tmp/uploads/%s", multipart_filename);
save_upload(path, request_body);

A safer implementation must canonicalize and validate the resulting path, reject traversal components, avoid following unexpected symbolic links, and enforce an allowlisted destination directory. Filename filtering alone is insufficient if alternate encodings, absolute paths, symlinks, or filesystem normalization can bypass checks.

from pathlib import Path

upload_root = Path("/tmp/uploads").resolve()
candidate = (upload_root / supplied_filename).resolve()

if upload_root not in candidate.parents:
    raise ValueError("path escapes upload directory")

candidate.write_bytes(body)

The example demonstrates a defensive principle, not a patch for the router. The CVE record confirms path traversal but does not confirm arbitrary file write, arbitrary file read, credential theft, persistence, or remote code execution. Those outcomes may be possible depending on the vulnerable operation and process permissions, but defenders should distinguish confirmed facts from potential exploit chains.

Severity, Explained

The assigned CVSS base score is 10.0, which is Critical. The available NVD result did not include the CVSS vector string, so the individual metric values cannot be stated reliably. The retrieved information does not establish the precise authentication requirement, user interaction requirement, scope, or confidentiality, integrity, and availability impacts used to calculate the score.

The score should drive urgent containment. The vulnerability is described as remotely attackable, affects network infrastructure, and has public exploit material associated with it. Routers frequently sit at trust boundaries and may expose administrative services to broad network segments, making a web-management flaw more operationally significant than its affected-device count might suggest.

Do not infer that every CVSS 10.0 consequence is confirmed by the vulnerability description. The record confirms path traversal; it does not independently confirm full device compromise or remote code execution. Risk assessment should combine the score with actual exposure, management-interface reachability, authentication controls, firmware status, and evidence from logs or network telemetry.

Is It Being Exploited?

The NVD record states that the exploit is public and may be used for attacks. It references a GitHub repository titled “COMFAST-CF-WR632AX-Wi-Fi-6-Router”:

https://github.com/FoundTL/COMFAST-CF-WR632AX-Wi-Fi-6-Router

That makes this more than a theoretical issue. Security teams should assume that capable attackers can obtain exploit guidance and adapt it to exposed devices. Public availability does not, by itself, prove that the code is reliable against all firmware configurations or that exploitation has occurred in a particular environment.

Confirmed in-the-wild exploitation was not established by the available sources. The CVE is also not listed in CISA’s Known Exploited Vulnerabilities catalog at the time of checking. Therefore, there is no CISA KEV date added, remediation deadline, required action, or ransomware-campaign indicator for this CVE.

KEV non-membership is not evidence that exploitation is absent; it only means CISA had not included the vulnerability in that catalog when checked.

Organizations should communicate both facts accurately: public exploit material exists, while confirmed active exploitation has not been established. Internet-exposed management interfaces deserve priority even without a confirmed campaign because routers are continuously scanned and often contain sensitive network configuration.