Comfast CF-WR632AXに脆弱性、PoC公開で修正版は未確認
Summary
Comfast CF-WR632AXの2.6.0.1に、認証なしでネットワーク越しに悪用できる脆弱性が公表され、エクスプロイトも公開されています。同機を使う拠点や店舗は、機器の洗い出しと管理機能の公開範囲の確認を先に進めてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Comfast CF-WR632AXの2.6.0.1に、認証なしでネットワーク越しに悪用できる脆弱性が公表され、エクスプロイトも公開されています。同機を使う拠点や店舗は、機器の洗い出しと管理機能の公開範囲の確認を先に進めてください。
Original description The description as published by the source.
A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web cna@vuldb.com
- web cna@vuldb.com
- web cna@vuldb.com
- web cna@vuldb.com
- web cna@vuldb.com
- web nvd.nist.gov
- web github.com