CVE-2026-122013
CriticalCVSS 10.0Summary
A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1 in an unknown functionality of /usr/bin/webmgnt within the Multipart Parser component. Manipulating the filename argument results in path traversal, the attack can be initiated remotely, the exploit is public, and the vendor did not respond.
Risk Assessment
A remote attacker could exploit path traversal to access files outside the intended directory, potentially exposing data or enabling further attacks on the device.
Recommendation
Restrict access to the device management interface, monitor for exploitation attempts, and consider applying fixes or compensating controls since the vendor has not responded.
Related vulnerabilities
- CVE-2026-82418Critical
IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 contain a use-after-free vulnerability that could allow a remote attacker to execute arbitrary code.
- CVE-2025-71457Critical
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication.
- CVE-2026-121933Critical
A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the Setup Wizard component. Manipulating the wizard_router_pwd argument can lead to missing authentication. The attack may be launched remotely, and the exploit has been published and may be used.
- CVE-2026-113373Critical
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account and then receives a new session with the roles of that account.
- CVE-2026-122120Critical
In Yealink Plug-in Softwares before 2.35.219.0, an unauthorized file write vulnerability exists under specific scenarios. It may be exploited by attackers to achieve remote code execution.
- CVE-2026-121932Critical
In Linksys E5350 1.0.00.037, the system function in /wizard/apply.cgi mishandles the ping_ip/traceroute_ip argument, resulting in OS command injection. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-121931Critical
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Traceroute Diagnostic component) mishandles the traceroute_ip argument, enabling OS command injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-121930Critical
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Ping Diagnostic component) mishandles the ping_ip argument, causing OS command injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-113780Critical
In ESP-IDF (Espressif IoT Development Framework) from 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary.
- CVE-2026-107846Critical
In bitcoinjs-lib (JavaScript Bitcoin library for Node.js and browsers) from 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. Validation paths can accept a recomputed root without checking for mutation, allowing a peer to append duplicate transactions while retaining the original Merkle root, block header, and proof of work.
Original NVD description (English source)
A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS