CVE-2025-9586
Published: 28 August 2025
Summary
CVE-2025-9586 is a low-severity Injection (CWE-74) vulnerability in Comfast Cf-N1 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Indirect Command Execution (T1202); ranked in the top 24.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-9586 is a command injection vulnerability affecting Comfast CF-N1 firmware version 2.6.0. The issue resides in the wireless_device_dissoc function within the /usr/bin/webmgnt file, where improper handling of the 'mac' argument enables command injection. Published on 2025-08-28, it is associated with CWE-74 and CWE-77, and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by an attacker possessing low privileges, requiring no user interaction. Successful exploitation allows arbitrary command execution on the affected device, with limited impacts on confidentiality, integrity, and availability.
Advisories documented on VulDB (ctiid.321699, id.321699, submit.636137) detail the vulnerability, while a GitHub repository provides a publicly available exploit at https://github.com/ZZ2266/.github.io/blob/main/COMFAST/N1V2/wireless_device_dissoc/readme.md. No specific patches or mitigations are referenced in the available information.
The exploit's public availability suggests potential for real-world use against vulnerable Comfast CF-N1 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-26145
Vulnerability details
A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipulation of the argument mac leads to command injection. The attack may be performed from a remote location. The exploit is…
more
publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote command injection via the 'mac' parameter in the wireless_device_dissoc function of /usr/bin/webmgnt enables indirect command execution (T1202), as explicitly mapped in the advisory.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the 'mac' argument in wireless_device_dissoc to block command injection payloads before execution.
Limits privileges of the webmgnt process or remote accounts so that successful injection yields only minimal impact on the CF-N1 device.
Verifies integrity of /usr/bin/webmgnt and detects unauthorized command execution or tampering from the public exploit.