CVE-2023-38862: Comfast Cf-XR11 Firmware

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub_431F64 function in bin/webmgnt.

Affected products

• Comfast Cf-XR11 Firmware: version 2.7.2 only

Published 2023-08-15. Last modified 2026-06-17.