Comfast CF-AC100 Command Injection Vulnerability in V2.6.0.8

A command injection vulnerability exists in the Comfast CF-AC100 router running firmware version 2.6.0.8. The issue arises in the request path '/cgi-bin/mbox-config?method=SET&section=ping_config', where the 'destination' field is improperly validated. This flaw allows remote attackers to execute arbitrary commands by sending crafted HTTP POST requests. Exploitation requires authentication and the presence of specific cookies.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/mbox-config?method=SET&section=ping_config' with a payload in the 'destination' field that includes the desired command. The request must include a valid session cookie to authenticate the user.