CVE-2026-19976
MediumCVSS 6.6Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
A remote attacker could execute arbitrary commands on the device, potentially leading to full control of the device and network.
Recommendation
It is recommended to restrict access to the device's administrative panel, apply available network security measures, and monitor the device for unauthorized activities.
Original NVD description (English source)
A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.