Comfast CF-N1-S vulnerabilities

A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected function sub_41AD7C in /cgi-bin/mbox-config is vulnerable to stack-based buffer overflow via the timestr/ntp_client_enabled arguments. The attack can be launched remotely and the exploit has been made public.

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1, affecting the system function in /cgi-bin/mbox-config?method=SET&section=ntp_timezone. Manipulation of the timestr argument results in command injection. The attack can be launched remotely and the exploit has been publicly released.

A vulnerability in Comfast CF-N1-S version 2.6.0.1 affects the function sub_44B50C in the file /cgi-bin/mbox-config?method=SET&section=ptest_channel. Manipulation results in a stack-based buffer overflow, and the attack can be launched remotely. The exploit has been made public and could be used.

In Comfast CF-N1-S version 2.6.0.1, the function sub_44B438 in /cgi-bin/mbox-config?method=SET&section=ptest_ssid (SSID Configuration component) has a stack-based buffer overflow via the ssid argument.

A flaw has been found in Comfast CF-N1-S 2.6.0.1, affecting the function get_para_from_uri in /cgi-bin/mbox-config. Manipulation of width/height arguments causes stack-based buffer overflow. The attack can be initiated remotely.

A flaw has been found in COMFAST CF-N1-S 2.6.0.1, impacting the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid. Manipulation of the argument ssid causes OS command injection. Remote exploitation is possible and the exploit has been published.

Vulnerability in Comfast CF-N1-S version 2.6.0.1 in the sprintf function of the file /cgi-bin/mbox-config?method=SET&section=ptest_sn is due to command injection via the sn argument. A remote attacker can exploit this flaw to execute arbitrary system commands.

A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET&section=ptest_macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.