Comfast CF-E7 Command Injection Vulnerability in Web Management Component

A command injection vulnerability exists in the Comfast CF-E7 router running firmware version 2.6.0.9. The issue arises in the web management component, specifically within the 'sub_441CF4' function of the 'mbox-config' CGI script. The vulnerability can be exploited remotely by manipulating the 'destination' parameter, leading to the execution of arbitrary commands on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected router.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/mbox-config?method=SET&section=ping_config' with a crafted 'destination' parameter. The request must include a valid session cookie to authenticate.