Comfast CF-E7 Command Injection Vulnerability in Web Management Component

A command injection vulnerability exists in the Comfast CF-E7 router running firmware version 2.6.0.9. The issue arises in the web management component, specifically within the 'sub_41ACCC' function of the '/cgi-bin/mbox-config?method=SET&section=ntp_timezone' endpoint. This vulnerability allows remote attackers to execute arbitrary commands by manipulating the 'timestr' parameter in the HTTP POST request. The exploitation requires the 'ntp' feature to be disabled.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/mbox-config?method=SET&section=ntp_timezone' with a crafted 'timestr' value that includes the desired command. Ensure that the 'ntp' feature is disabled on the router.