CVE-2026-12814 is an OS command injection vulnerability affecting Comfast CF-WR631AX V3 firmware versions 2.7.0.0 through 2.7.0.8. The vulnerability exists in the system function called by the API endpoint /cgi-bin/mbox-config?section=ping_config, where manipulation of the 'destination' parameter enables remote attackers to execute arbitrary operating system commands. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. Although an exploit is publicly available, the vendor has not issued any advisory or patch.

Successful exploitation allows remote attackers to execute arbitrary OS commands on affected devices, potentially leading to full system compromise. This can impact device availability, confidentiality, and integrity. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the moderate impact and ease of exploitation without user interaction.

No official fix or patch is currently available from the vendor. Users should consider restricting access to the vulnerable API endpoint via network controls or firewall rules to limit exposure. Monitor for any vendor advisories for future patches. Due to the lack of vendor response, alternative mitigations such as disabling the vulnerable service or upgrading to a different device may be necessary.