Comfast CF-WR632AX, CVE-2026-122013: a new CVE scored 10

The bottom line

Check whether you run Comfast CF-WR632AX. If you do, read the vendor's page for the fixed version and update. Nothing public says yet that anyone is using this flaw.

Free analysis report · 9 pagesComfast CF-WR632AX, CVE-2026-122013: a new CVE scored 10The same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

An attacker who can reach the router's web management interface can supply a crafted filename to the multipart parser and traverse directory paths. The GitHub source in the record names this an arbitrary file write.

Why it matters

The multipart parser does not constrain the filename argument, allowing a crafted value to traverse directory boundaries. The GitHub source names this an arbitrary file write; the record describes path traversal via the filename. Our reading is that an attacker who can reach the management interface could write files anywhere on the device, potentially overwriting configuration or system files. The CVSS 4.0 score is 10, the maximum on that scale. The exploit is public and the vendor did not respond to disclosure.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• If the router is on an internal network, it cannot be exploited. The record says the attack is possible remotely. Any user who can reach the web management interface, including internal users, can attempt it.
• A patched firmware version is available to update to. The record lists no unaffected releases. No fixed firmware version is recorded and the vendor did not respond to disclosure.

How we would triage it

This is our judgement.

Step 1: Find the firmware version on your router

• Log in to the Comfast CF-WR632AX web management interface and locate the firmware or system information page.
• If the version shown is 2.6.0.1, the device is in the version the record names as affected.

Step 2: Restrict access to the web management interface

• Block access to the router's management interface from untrusted networks, including the internet.
• Limit management access to specific administrator IP addresses where the router supports it.

Step 3: Watch for a vendor firmware update

• No fixed version is recorded and the vendor did not respond to the researcher's disclosure.
• Check the Comfast support or downloads page for new firmware; apply it when one that addresses this flaw appears.

Step 4: Check for unexpected file changes if the interface was exposed

• If the management interface was reachable by untrusted users while on firmware 2.6.0.1, review the router's configuration and system files for unexpected additions or changes.
• Consider replacing the device if its integrity cannot be confirmed.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

The weakness behind it

The record classes this as CWE-22.

• CWE-22 →What this kind of mistake is, and which exploited vulnerabilities share it.

The sources, in their words

The CVE record:

A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Versions of Comfast CF-WR632AX the record lists as affected:

• 2.6.0.1

The record gives no version ranges. Use the vendor's advisory for the affected versions.

Check your own project

If you build software, you can compare what a project declares with this CVE from a terminal. The tool reads requirements files, package.json, Maven, Gradle, Cargo, CMake and Dockerfile files, runs nothing, and only the CVE id leaves your machine. Naming the CVEs needs no key.

lattice-scan project . --cve CVE-2026-122013

Each row says in-range, outside-range, undetermined or lead, with the file and line. That is evidence about what a manifest declares, not about what runs, and a person decides. The verdicts, the CSV columns and a pipeline recipe are in the guide.

Check the servers you run

The same id can be checked against a host. Run this on the machine itself, not on the laptop that deploys to it: it reads installed packages (dpkg, rpm or apk), snaps, the names of running container images and the kernel version, compares them on the spot, and only the CVE ids leave the machine; the inventory stays on it, in ~/.lattice-scan. Naming the CVEs needs no key. Do it on each server after a deployment, and again when a new entry lands.

lattice-scan --cve CVE-2026-122013

A match is a candidate for a person to confirm, not a finding. A distribution can fix a CVE under an unchanged version number, so a match is a candidate; on Debian-family hosts the report also shows whether the package's own changelog names the CVE. It reads the names of the running images, not what is inside them; for what an image declares, use the project check on its Dockerfile.

Guide: namiq.io/lattice/guides/choose-your-channel. MCP server (io.namiq/lattice in the MCP registry): namiq.io/lattice. Package: pypi.org/project/lattice-scan, or namiq.io/apt.

• Which way into Lattice fits your job →The command line, the Claude skill or the MCP server: what each needs, what works without a key and how to read the result.
• Lattice, the MCP server →The public graph the command reads, for AI agents over MCP.
• Install and connect →The signed apt repository, the fingerprint, and the connection commands for each client.

What we do not know yet

• Whether authentication is required to trigger the flaw, or whether it can be reached before login.
• Whether any firmware version other than 2.6.0.1 is affected.
• Whether the vendor has acknowledged the report or plans a fix.
• Exploitation is not recorded. That is not the same as none.
• This is a new record: scores, versions and wording can change in the first days, and they are as at 5 November 2026. We read the vendor pages listed under Sources; nothing here has been tested.
• The sections headed "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong" and "How we would triage it" are our interpretation of the sources, not a statement by CISA or the vendor.

• The day's CVE highlight →The three new records we picked that day, and how we chose them.
• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.