CVE-2026-94003
CriticalCVSS 10.0Summary
A stack-based buffer overflow vulnerability was found in Comfast CF-N1-S 2.6.0.1 in the get_css_path_from_uri function of /cgi-bin/mbox-config in the Web Management Interface. The attack can be initiated remotely, and the exploit has been publicly disclosed and may be used.
Risk Assessment
A remote attacker could exploit the buffer overflow to execute arbitrary code or crash the device, potentially leading to compromise of the router and network. Public availability of the exploit increases the risk of rapid exploitation.
Recommendation
Update the Comfast CF-N1-S firmware to the latest available version and restrict access to the management interface from untrusted networks.
Other vulnerabilities in Comfast CF-N1-S
See all- CVE-2026-78050Critical
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected function sub_41AD7C in /cgi-bin/mbox-config is vulnerable to stack-based buffer overflow via the timestr/ntp_client_enabled arguments. The attack can be launched remotely and the exploit has been made public.
- CVE-2026-77683Critical
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1, affecting the system function in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. Manipulation of the timestr argument results in command injection. The attack can be launched remotely and the exploit has been publicly released.
- CVE-2026-77148Critical
A vulnerability in Comfast CF-N1-S version 2.6.0.1 affects the function sub_44B50C in the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel. Manipulation results in a stack-based buffer overflow, and the attack can be launched remotely. The exploit has been made public and could be used.
- CVE-2026-77022Critical
In Comfast CF-N1-S version 2.6.0.1, the function sub_44B438 in /cgi-bin/mbox-config?method=SET§ion=ptest_ssid (SSID Configuration component) has a stack-based buffer overflow via the ssid argument.
- CVE-2026-76008Critical
A flaw has been found in Comfast CF-N1-S 2.6.0.1, affecting the function get_para_from_uri in /cgi-bin/mbox-config. Manipulation of width/height arguments causes stack-based buffer overflow. The attack can be initiated remotely.
- CVE-2026-75094Critical
A flaw has been found in COMFAST CF-N1-S 2.6.0.1, impacting the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_ssid. Manipulation of the argument ssid causes OS command injection. Remote exploitation is possible and the exploit has been published.
- CVE-2026-77004High
Vulnerability in Comfast CF-N1-S version 2.6.0.1 in the sprintf function of the file /cgi-bin/mbox-config?method=SET§ion=ptest_sn is due to command injection via the sn argument. A remote attacker can exploit this flaw to execute arbitrary system commands.
- CVE-2026-19976Medium
A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.