← Vulnerability feed

Vulnerability record · CVE-2025-9581 · published 28 August 2025

CVE-2025-9581: Comfast cf-n1 firmware injection vulnerability

Comfast · Cf N1 Firmware

A vulnerability was detected in Comfast CF-N1 2.6.0. This impacts the function multi_pppoe of the file /usr/bin/webmgnt. Performing manipulation of the argument phy_interface results in command injection. The attack may be initiated remotely. The exploit is now public and may be used.

2.1 CVSS 4.0 Low EPSS 5.3% · top 7.7% CWE-74 · InjectionCWE-77 · Command injection
2.1CVSS 4.0 base score, v2 6.5
5.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 2 tagged exploit
26 Sep 2026Last modified by NVD

Description

A vulnerability was detected in Comfast CF-N1 2.6.0. This impacts the function multi_pppoe of the file /usr/bin/webmgnt. Performing manipulation of the argument phy_interface results in command injection. The attack may be initiated remotely. The exploit is now public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/ZZ2266/.github.io/tree/main/COMFAST/N1V2/multi_pppoe ExploitThird Party Advisory
https://vuldb.com/?ctiid.321694 Permissions RequiredVDB Entry
https://vuldb.com/?id.321694 Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.636127 Third Party AdvisoryVDB Entry
https://github.com/ZZ2266/.github.io/tree/main/COMFAST/N1V2/multi_pppoe ExploitThird Party Advisory

Track CVE-2025-9581 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

2.1CVE-2026-2535Comfast cf-n1 firmware injection vulnerabilityA vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub_44AB9C of the file /cgi-bin/mbox-config?method=SET&se…EPSS 14%2.1CVE-2026-2534Comfast cf-n1 firmware injection vulnerabilityA vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=S…EPSS 14%2.1CVE-2025-9585Comfast cf-n1 firmware injection vulnerabilityA vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This manipula…EPSS 5.1%2.1CVE-2025-9586Comfast cf-n1 firmware injection vulnerabilityA vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. S…EPSS 8.3%2.1CVE-2025-9582Comfast cf-n1 firmware injection vulnerabilityA flaw has been found in Comfast CF-N1 2.6.0. Affected is the function ntp_timezone of the file /usr/bin/webmgnt. Executing manipulation of the argum…EPSS 5.3%2.1CVE-2025-9583Comfast cf-n1 firmware injection vulnerabilityA vulnerability has been found in Comfast CF-N1 2.6.0. Affected by this vulnerability is the function ping_config of the file /usr/bin/webmgnt. The m…EPSS 5.1%2.1CVE-2025-9584Comfast cf-n1 firmware injection vulnerabilityA vulnerability was found in Comfast CF-N1 2.6.0. Affected by this issue is the function update_interface_png of the file /usr/bin/webmgnt. The manip…EPSS 8.3%10.0CVE-2025-20337Cisco ISE API input validation flaw allows unauthenticated root RCECisco ISE and ISE-PIC fail to properly validate user-supplied input in a specific API, letting an unauthenticated remote attacker execute arbitrary c…KEVEPSS 68%analysed

Source: NIST National Vulnerability Database (record CVE-2025-9581), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.