This vulnerability affects COMFAST CF-N1-S version 2.6.0.1 in the CGI interface component. The function sub_44B438 processes requests to /cgi-bin/mbox-config with parameters method=SET and section=ptest_ssid. Improper sanitization of the ssid argument enables OS command injection, allowing remote attackers to execute arbitrary commands on the device. The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity. Exploit code is publicly available, increasing the risk of exploitation. No vendor advisory or patch information is provided, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full system compromise, data theft, or disruption of service. The high CVSS score reflects the critical nature and ease of remote exploitation without user interaction. Although no known active exploitation in the wild is reported, published exploit code increases the likelihood of attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is provided, users should monitor vendor communications closely. Until a patch is available, restricting access to the vulnerable CGI interface endpoint and applying network-level controls to limit exposure may reduce risk.