Cyber Posture

CVE-2025-9581

MediumPublic PoC

Published: 28 August 2025

Published
28 August 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0060 69.5th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-9581 is a medium-severity Injection (CWE-74) vulnerability in Comfast Cf-N1 Firmware. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 30.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Unix Shell (T1059.004) and 2 other techniques.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-74

Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.

addresses: CWE-74

Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
Why these techniques?

Command injection in the web management binary (/usr/bin/webmgnt) via phy_interface enables exploitation of a public-facing web application (T1190), indirect command execution through the vulnerable function (T1202), and Unix shell command execution (T1059.004).

NVD Description

A vulnerability was detected in Comfast CF-N1 2.6.0. This impacts the function multi_pppoe of the file /usr/bin/webmgnt. Performing manipulation of the argument phy_interface results in command injection. The attack may be initiated remotely. The exploit is now public and may…

more

be used.

Deeper analysisAI

CVE-2025-9581 is a command injection vulnerability in Comfast CF-N1 firmware version 2.6.0, affecting the multi_pppoe function within the /usr/bin/webmgnt file. The issue arises from improper handling of the phy_interface argument, allowing injected commands to be executed. Published on 2025-08-28, it is associated with CWEs-74 and CWE-77 and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

A remote attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables command injection, resulting in limited impacts to confidentiality, integrity, and availability, such as unauthorized access to system resources or execution of arbitrary commands within the context of the affected process.

References include VulDB advisories at https://vuldb.com/?ctiid.321694, https://vuldb.com/?id.321694, and https://vuldb.com/?submit.636127, along with public exploit code on GitHub at https://github.com/ZZ2266/.github.io/tree/main/COMFAST/N1V2/multi_pppoe. The exploit is publicly available and may be used, but no specific patch or mitigation details are provided in the referenced sources.

Details

CWE(s)

Affected Products

comfast
cf-n1 firmware
2.6.0

CVEs Like This One

CVE-2025-9583Same product: Comfast Cf-N1
CVE-2025-9582Same product: Comfast Cf-N1
CVE-2026-2535Same product: Comfast Cf-N1
CVE-2025-9585Same product: Comfast Cf-N1
CVE-2025-9586Same product: Comfast Cf-N1
CVE-2025-9584Same product: Comfast Cf-N1
CVE-2026-2534Same product: Comfast Cf-N1
CVE-2026-2537Same vendor: Comfast
CVE-2026-2824Same vendor: Comfast
CVE-2026-2823Same vendor: Comfast

References