A critical command injection vulnerability in the COMFAST CF-XR11 router firmware allows unauthenticated remote attackers to achieve full device compromise.

This is a command injection vulnerability occurring within the multi_pppoe API. An unauthenticated attacker can inject arbitrary commands by submitting a crafted POST request to the /cgi-bin/mbox-config endpoint where the phy_interface parameter is passed into a system call without adequate sanitization.

The ability to execute arbitrary commands on a network device poses a severe risk to organizational security. Successful exploitation grants an attacker full control over the router, potentially enabling unauthorized access to sensitive internal network traffic, credential theft, or the use of the device as a pivot point into the internal infrastructure. With a CVSS score of 8.8, this flaw represents a high-severity threat that requires immediate attention to prevent total system compromise.

Immediate Action: Since a specific patch is currently unknown, administrators should immediately restrict access to the web management interface of the affected devices to trusted IP addresses only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /cgi-bin/mbox-config endpoint and audit the system for signs of unauthorized persistence or unexpected background processes.

Compensating Controls: If possible, place the affected device behind a firewall that enforces strict ingress filtering and blocks unauthorized access to administrative web interfaces from external networks.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced security researcher write-up.

Given the ease of exploitation and the potential for full device takeover, this vulnerability must be treated as a high priority. Organizations utilizing COMFAST CF-XR11 devices should verify firmware versions immediately and apply vendor updates as soon as they become available. In the absence of a vendor patch, network-level isolation of the management interface is the most effective method to mitigate the risk of remote code execution.