CVE-2025-9585

HighCVSS 8.8/10Last modified Sep 26, 2026

Description

A vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This manipulation of the argument portal_delete_picname causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
Comfast	CF-N1	2.6.0

References

https://github.com/ZZ2266/.github.io/blob/main/COMFAST/N1V2/wifilith_delete_pic_file/readme.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.321698Permissions Required, VDB Entry
https://vuldb.com/?id.321698Third Party Advisory, VDB Entry
https://vuldb.com/?submit.636136Third Party Advisory, VDB Entry

Timeline

Published: Aug 28, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-95868.8A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/w CVE-2025-95878.6The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statem CVE-2025-95889.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services CVE-2025-95892.5A vulnerability was determined in Cudy WR1200EA 2.3.7-20250113-121810. Affected is an unknown function of the file /etc/shadow. Executing ma CVE-2025-95903.5A vulnerability was identified in Weaver E-Mobile Mobile Management Platform up to 20250813. Affected by this vulnerability is an unknown fu CVE-2025-95912.4A security vulnerability has been detected in ZrLog up to 3.1.5. This vulnerability affects unknown code of the file /api/admin/template/con CVE-2025-95929.8A vulnerability was detected in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /report CVE-2025-95939.8A flaw has been found in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /report/unit_status_info.CVE-2025-95949.8A vulnerability has been found in itsourcecode Apartment Management System 1.0. The affected element is an unknown function of the file /rep CVE-2025-95956.1A vulnerability was found in code-projects Student Information Management System 1.0. The impacted element is an unknown function of the fil CVE-2025-95969.8A vulnerability was determined in itsourcecode Sports Management System 1.0. This affects an unknown function of the file /login.php. This m CVE-2025-95979.8A vulnerability was identified in itsourcecode Apartment Management System 1.0. This impacts an unknown function of the file /o_dashboard/re