← Vulnerability feed

Vulnerability record · CVE-2025-9582 · published 28 August 2025

CVE-2025-9582: Comfast cf-n1 firmware injection vulnerability

Comfast · Cf N1 Firmware

A flaw has been found in Comfast CF-N1 2.6.0. Affected is the function ntp_timezone of the file /usr/bin/webmgnt. Executing manipulation of the argument timestr can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used.

2.1 CVSS 4.0 Low EPSS 5.3% · top 7.7% CWE-74 · InjectionCWE-77 · Command injection
2.1CVSS 4.0 base score, v2 6.5
5.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 2 tagged exploit
26 Sep 2026Last modified by NVD

Description

A flaw has been found in Comfast CF-N1 2.6.0. Affected is the function ntp_timezone of the file /usr/bin/webmgnt. Executing manipulation of the argument timestr can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/ZZ2266/.github.io/tree/main/COMFAST/N1V2/ntp_timezone ExploitThird Party Advisory
https://vuldb.com/?ctiid.321695 Permissions RequiredVDB Entry
https://vuldb.com/?id.321695 Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.636128 Third Party AdvisoryVDB Entry
https://github.com/ZZ2266/.github.io/tree/main/COMFAST/N1V2/ntp_timezone ExploitThird Party Advisory

Track CVE-2025-9582 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

2.1CVE-2026-2535Comfast cf-n1 firmware injection vulnerabilityA vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub_44AB9C of the file /cgi-bin/mbox-config?method=SET&se…EPSS 14%2.1CVE-2026-2534Comfast cf-n1 firmware injection vulnerabilityA vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=S…EPSS 14%2.1CVE-2025-9585Comfast cf-n1 firmware injection vulnerabilityA vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This manipula…EPSS 5.1%2.1CVE-2025-9586Comfast cf-n1 firmware injection vulnerabilityA vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. S…EPSS 8.3%2.1CVE-2025-9583Comfast cf-n1 firmware injection vulnerabilityA vulnerability has been found in Comfast CF-N1 2.6.0. Affected by this vulnerability is the function ping_config of the file /usr/bin/webmgnt. The m…EPSS 5.1%2.1CVE-2025-9584Comfast cf-n1 firmware injection vulnerabilityA vulnerability was found in Comfast CF-N1 2.6.0. Affected by this issue is the function update_interface_png of the file /usr/bin/webmgnt. The manip…EPSS 8.3%2.1CVE-2025-9581Comfast cf-n1 firmware injection vulnerabilityA vulnerability was detected in Comfast CF-N1 2.6.0. This impacts the function multi_pppoe of the file /usr/bin/webmgnt. Performing manipulation of t…EPSS 5.3%10.0CVE-2025-20337Cisco ISE API input validation flaw allows unauthenticated root RCECisco ISE and ISE-PIC fail to properly validate user-supplied input in a specific API, letting an unauthenticated remote attacker execute arbitrary c…KEVEPSS 68%analysed

Source: NIST National Vulnerability Database (record CVE-2025-9582), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.