This vulnerability affects COMFAST CF-N1-S version 2.6.0.1 and involves a command injection flaw in the sub_44A968 function of the /cgi-bin/mbox-config?method=SET&section=ptest_macaddress endpoint. By manipulating the macaddress argument, an attacker can execute arbitrary commands remotely. The vulnerability has been publicly disclosed, but the vendor has not provided a fix or response. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, availability, and scope.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially compromising system integrity and availability. The impact is rated medium based on the CVSS 4.0 score of 5.1. There are no known exploits in the wild at this time.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users should monitor vendor communications for updates. Until a fix is released, consider restricting access to the vulnerable endpoint and applying network-level controls to limit exposure.