CVE-2026-77683
CriticalCVSS 9.9Summary
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1, affecting the system function in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. Manipulation of the timestr argument results in command injection. The attack can be launched remotely and the exploit has been publicly released.
Risk Assessment
An attacker can remotely execute arbitrary system commands on the device, potentially leading to full compromise of the device and the network it is connected to.
Recommendation
Immediately update the device firmware to the latest version if available, and restrict access to the administrative panel to trusted IP addresses only.
Original NVD description (English source)
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.