CVE-2025-9582 is a medium severity (CVSS 6.3) command injection in the Comfast CF-N1, firmware 2.6.0. The ntp_timezone function in /usr/bin/webmgnt passes the timestr argument on unsafely. A public exploit is reported and no fix is listed, so restrict access to the management interface.
What's affected
The record lists the Comfast CF-N1 and its firmware, version 2.6.0. The vulnerable function is ntp_timezone in the binary /usr/bin/webmgnt, and the manipulated argument is timestr. The description says the attack may be started remotely and that the exploit has been published.
The write up cited by the record returned a not found page when I fetched it, and no vendor advisory is listed. I could not confirm a fixed firmware, so check the Comfast support site for your exact model and revision.
The weaknesses are CWE-77 (command injection) and its parent CWE-74 (injection). The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L: network reachable, low complexity, low privileges required, no user interaction. The privilege requirement is one reason this is rated medium and not high.
How to check if you're exposed
Read the firmware version on the device's status page. Version 2.6.0 on a CF-N1 is in scope. Then work out who can reach the management interface. From a different network, and only against addresses you own:
nmap -p 80,443,8080 <device-address>
If the page answers from the internet, remote management is exposed. Because the vector needs a logged in account, also review the list of admin users and recent logins, and change any default or shared password.
What to do now
- Confirm the firmware version of every CF-N1 you run.
- Turn off remote management, or limit it to a trusted address range or a VPN.
- Change the admin password and remove accounts you do not recognise.
- Check the Comfast support site for newer firmware for your hardware revision, and install it if it exists.
- If the device is end of life, schedule a replacement and keep it away from sensitive network segments.
Why it matters
Command injection means a value typed into a web form ends up inside a command run by the operating system on the device. If the value is not cleaned up, extra text can change which command runs. On an embedded device that usually means the commands run with high privilege.
The record scores each of confidentiality, integrity and availability as low and requires a login, which keeps the number at 6.3. A router or access point holds Wi-Fi keys and sits on the path of every connected device, so treat it as important even at this score. The record says the CVE is not in the CISA Known Exploited Vulnerabilities catalog, while a public exploit is reported.
Quick check
Is CVE-2025-9582 fixed?
The record lists no fixed firmware and I could not reach an advisory that names one. Check the Comfast support site for your revision.
Is this related to CVE-2025-9581?
Both records name the same binary, /usr/bin/webmgnt, with different functions and arguments. They are separate CVEs, so a fix would need to cover both. Check the vendor for confirmation.
Sources
- The write up cited by the record returned a not found page when fetched, so this post rests on the record fields
- Safeguard Gold entry: CVE-2025-9582
- CVE record fields as held in the Safeguard CVE record
Last reviewed: 18 October 2026.
