CVE-2026-77004: Command Injection in Comfast CF-N1-S

A command injection vulnerability was identified in Comfast CF-N1-S firmware version 2.6.0.1. The issue occurs in the sprintf function of the /cgi-bin/mbox-config?method=SET&section=ptest_sn endpoint, where manipulation of the 'sn' parameter can lead to arbitrary command execution. The attack vector is remote with low attack complexity and no user interaction required. Exploit code is publicly available, increasing the risk of exploitation. No official remediation or patch has been documented in the provided data.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption of the device's operation. Given the medium CVSS score, the impact is significant but not critical. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the affected endpoint and monitor for suspicious activity related to the 'sn' parameter. Avoid exposing the device management interface to untrusted networks.