CVE-2026-77004
HighCVSS 7.4Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
Vulnerability in Comfast CF-N1-S version 2.6.0.1 in the sprintf function of the file /cgi-bin/mbox-config?method=SET§ion=ptest_sn is due to command injection via the sn argument. A remote attacker can exploit this flaw to execute arbitrary system commands.
Risk Assessment
The risk for the organization is the possibility of remote command execution by an attacker, potentially leading to full device and network compromise.
Recommendation
It is recommended to update the device firmware to the latest version and restrict access to the administrative panel to trusted users only.
Other vulnerabilities in Comfast CF-N1-S
See all- CVE-2026-78050Critical
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected function sub_41AD7C in /cgi-bin/mbox-config is vulnerable to stack-based buffer overflow via the timestr/ntp_client_enabled arguments. The attack can be launched remotely and the exploit has been made public.
- CVE-2026-77683Critical
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1, affecting the system function in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. Manipulation of the timestr argument results in command injection. The attack can be launched remotely and the exploit has been publicly released.
- CVE-2026-77148Critical
A vulnerability in Comfast CF-N1-S version 2.6.0.1 affects the function sub_44B50C in the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel. Manipulation results in a stack-based buffer overflow, and the attack can be launched remotely. The exploit has been made public and could be used.
- CVE-2026-77022Critical
In Comfast CF-N1-S version 2.6.0.1, the function sub_44B438 in /cgi-bin/mbox-config?method=SET§ion=ptest_ssid (SSID Configuration component) has a stack-based buffer overflow via the ssid argument.
- CVE-2026-76008Critical
A flaw has been found in Comfast CF-N1-S 2.6.0.1, affecting the function get_para_from_uri in /cgi-bin/mbox-config. Manipulation of width/height arguments causes stack-based buffer overflow. The attack can be initiated remotely.
- CVE-2026-75094Critical
A flaw has been found in COMFAST CF-N1-S 2.6.0.1, impacting the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_ssid. Manipulation of the argument ssid causes OS command injection. Remote exploitation is possible and the exploit has been published.
- CVE-2026-19976Medium
A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET§ion=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.