CVE-2025-9586
Published: 28 August 2025
Summary
CVE-2025-9586 is a medium-severity Injection (CWE-74) vulnerability in Comfast Cf-N1 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Indirect Command Execution (T1202); ranked in the top 33.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote command injection via the 'mac' parameter in the wireless_device_dissoc function of /usr/bin/webmgnt enables indirect command execution (T1202), as explicitly mapped in the advisory.
NVD Description
A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipulation of the argument mac leads to command injection. The attack may be performed from a remote location. The exploit is…
more
publicly available and might be used.
Deeper analysisAI
CVE-2025-9586 is a command injection vulnerability affecting Comfast CF-N1 firmware version 2.6.0. The issue resides in the wireless_device_dissoc function within the /usr/bin/webmgnt file, where improper handling of the 'mac' argument enables command injection. Published on 2025-08-28, it is associated with CWE-74 and CWE-77, and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by an attacker possessing low privileges, requiring no user interaction. Successful exploitation allows arbitrary command execution on the affected device, with limited impacts on confidentiality, integrity, and availability.
Advisories documented on VulDB (ctiid.321699, id.321699, submit.636137) detail the vulnerability, while a GitHub repository provides a publicly available exploit at https://github.com/ZZ2266/.github.io/blob/main/COMFAST/N1V2/wireless_device_dissoc/readme.md. No specific patches or mitigations are referenced in the available information.
The exploit's public availability suggests potential for real-world use against vulnerable Comfast CF-N1 devices.
Details
- CWE(s)