CVE-2024-44466

Published: Sep 11, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter iface.

Affected (1)

Products: Comfast: Cf Xr11 Firmware

Comfast

1 product

Cf Xr11 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Comfast Cf Xr11 Firmware	Version 2.7.2

Running on/with	Platform Versions
Comfast Cf Xr11	All versions

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (1)

https://github.com/CurryRaid/iot_vul/tree/main/comfast

Source: cve@mitre.org

ExploitThird Party Advisory

Timeline

No history available yet.