CVE-2026-15511 | Comfast CF-WR631AX V3 up to 2.7.0.8 FastCGI Backend /usr/bin/webmgnt system_wl_upload_pic_file filename os command injection

A vulnerability was found in Comfast CF-WR631AX V3 up to 2.7.0.8. It has been rated as critical. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection.

The identification of this vulnerability is CVE-2026-15511. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.