CVE-2025-9586 is a critical command injection vulnerability affecting Comfast CF-N1 2.6.0 firmware, specifically within the wireless_device_dissoc function of /usr/bin/webmgnt. An attacker can remotely exploit this by manipulating the 'mac' argument, leading to arbitrary command execution. With a CVSS score of 8.8 (High), this vulnerability presents a significant risk due to its low attack complexity and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or inclusion in CISA's KEV catalog, a public exploit is available, and its FAUCET Risk Score of 83/100 indicates a high potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.6.0CPE matchmatch criteria | cpe:2.3:o:comfast:cf-n1_firmware:2.6.0:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.