This vulnerability affects COMFAST CF-N1-S version 2.6.0.1 and involves command injection via the macaddress parameter in the sub_44A968 function of the /cgi-bin/mbox-config?method=SET&section=ptest_macaddress CGI endpoint. An attacker can remotely exploit this flaw by manipulating the macaddress argument to execute arbitrary commands on the device. The vulnerability has been publicly disclosed, but the vendor has not issued any response or fix. No known exploits are currently reported in the wild.

Successful exploitation allows an attacker to execute arbitrary commands remotely on the affected device, potentially leading to unauthorized control or disruption of the device's operation. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited scope and impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider restricting access to the vulnerable endpoint and monitor for suspicious activity. Avoid exposing the device's management interface to untrusted networks until a fix is provided.