{"id":"CVE-2026-122013","published":"2026-11-04T21:18:07.540","lastModified":"2026-11-04T21:18:07.710","description":"A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/FoundTL/COMFAST-CF-WR632AX-Wi-Fi-6-Router","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-122013","tags":[]},{"url":"https://vuldb.com/submit/1023251","tags":[]},{"url":"https://vuldb.com/vuln/431080","tags":[]},{"url":"https://vuldb.com/vuln/431080/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/FoundTL/COMFAST-CF-WR632AX-Wi-Fi-6-Router","tags":[]}],"hasPoc":true,"ai":{"summary":"A path traversal flaw in the Multipart Parser component of the /usr/bin/webmgnt binary allows unauthenticated remote attackers to read arbitrary files on the device by manipulating the filename argument in a multipart request.","exploitability":"Trivial to exploit remotely with no authentication or user interaction required, as the vulnerable endpoint is publicly accessible and a public exploit exists.","blast_radius":"Complete compromise of confidentiality, integrity, and availability due to the CVSS 10.0 score, enabling full device takeover, credential theft, and lateral movement within the network.","remediation":"Upgrade to firmware version 2.6.0.2 or later if available; otherwise, immediately disable or restrict access to the /usr/bin/webmgnt endpoint and monitor for exploitation attempts.","detection":"Look for HTTP requests containing '..' sequences in multipart filename parameters to the /webmgnt endpoint, especially with non-standard file extensions or attempts to access sensitive paths like /etc/passwd or /etc/shadow.","tags":["path-traversal","web","iot","critical","public-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:43:51.288Z"}}