A critical, unauthenticated path traversal flaw in the Multipart Parser of the Comfast CF-WR632AX router (firmware 2.6.0.1) is remotely exploitable, and a public exploit is already available.
What Is It
CVE-2026-122013 is a path traversal vulnerability (CWE-22) in /usr/bin/webmgnt on the Comfast CF-WR632AX. The bug is in the device's Multipart Parser component. The record identifies the affected logic only as "unknown functionality" within that binary. An attacker triggers it by manipulating the filename argument, which results in path traversal.
VulDB, acting as the CNA, published the issue on 2026-11-04. NVD lists the record's status as "Deferred," which means NVD has not done its own analysis. All scoring and affected-product data below comes from VulDB.
Why It Matters
The CNA scores this at the top of the scale:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, with Exploit Maturity set to Proof-of-Concept
- CVSS 2.0: 10.0
The attack works over the network with low complexity. It needs no privileges and no user interaction, and the scope is marked as changed. The record says "the exploit is now public and may be used," and a public research repository is listed in the references.
KEV status: This CVE has no entry in the CISA Known Exploited Vulnerabilities catalog. CISA has not confirmed active exploitation, and there is no CISA-mandated remediation deadline. However, a public proof-of-concept means the barrier to exploitation is low.
What's Vulnerable
- Vendor: Comfast
- Product: CF-WR632AX (Wi-Fi 6 router)
- Affected version: 2.6.0.1
- Component: Multipart Parser (
/usr/bin/webmgnt) - CPE:
cpe:2.3:a:comfast:cf-wr632ax:*:*:*:*:*:*:*:*
The supplied data does not say whether other firmware versions are affected.
Patch Status
The supplied sources list no patch, fixed version or vendor advisory. According to the disclosure, the vendor was contacted early about this issue "but did not respond in any way." Owners of CF-WR632AX devices on 2.6.0.1 should assume the device is unpatched. They should check with Comfast and the references below for any updates.