CVE-2026-15511 is an OS command injection vulnerability affecting Comfast CF-WR631AX V3 devices with firmware versions 2.7.0.0 to 2.7.0.8. The flaw resides in the system_wl_upload_pic_file function within the FastCGI backend (/usr/bin/webmgnt), where improper handling of the filename argument enables remote attackers to inject and execute arbitrary operating system commands. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 9.3 (critical). The vendor was notified but has not issued any fix or advisory, and no official remediation is currently available.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on affected devices, potentially leading to full system compromise. This can result in unauthorized control over the device, data theft, disruption of network services, or use of the device as a foothold for further attacks. The vulnerability is critical due to its remote, unauthenticated nature and high impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available from the vendor. Users should consider isolating affected devices from untrusted networks and monitoring for suspicious activity. Applying network-level protections such as firewall rules to restrict access to the device management interface may reduce exposure. Check the vendor's channels regularly for updates or official fixes.