CVE-2025-9582

CriticalCVSS 9.8/10Last modified Sep 26, 2026

Description

A flaw has been found in Comfast CF-N1 2.6.0. Affected is the function ntp_timezone of the file /usr/bin/webmgnt. Executing manipulation of the argument timestr can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
Comfast	CF-N1	2.6.0

References

https://github.com/ZZ2266/.github.io/tree/main/COMFAST/N1V2/ntp_timezoneExploit, Third Party Advisory
https://vuldb.com/?ctiid.321695Permissions Required, VDB Entry
https://vuldb.com/?id.321695Third Party Advisory, VDB Entry
https://vuldb.com/?submit.636128Third Party Advisory, VDB Entry
https://github.com/ZZ2266/.github.io/tree/main/COMFAST/N1V2/ntp_timezoneExploit, Third Party Advisory

Timeline

Published: Aug 28, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-95838.8A vulnerability has been found in Comfast CF-N1 2.6.0. Affected by this vulnerability is the function ping_config of the file /usr/bin/webmg CVE-2025-95848.8A vulnerability was found in Comfast CF-N1 2.6.0. Affected by this issue is the function update_interface_png of the file /usr/bin/webmgnt. CVE-2025-95858.8A vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This CVE-2025-95868.8A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/w CVE-2025-95878.6The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statem CVE-2025-95889.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services CVE-2025-95892.5A vulnerability was determined in Cudy WR1200EA 2.3.7-20250113-121810. Affected is an unknown function of the file /etc/shadow. Executing ma CVE-2025-95903.5A vulnerability was identified in Weaver E-Mobile Mobile Management Platform up to 20250813. Affected by this vulnerability is an unknown fu CVE-2025-95912.4A security vulnerability has been detected in ZrLog up to 3.1.5. This vulnerability affects unknown code of the file /api/admin/template/con CVE-2025-95929.8A vulnerability was detected in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /report CVE-2025-95939.8A flaw has been found in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /report/unit_status_info.CVE-2025-95949.8A vulnerability has been found in itsourcecode Apartment Management System 1.0. The affected element is an unknown function of the file /rep