This vulnerability in Comfast CF-N1-S 2.6.0.1 arises from improper handling of input in the sub_44B50C function of the Web Management interface, leading to a stack-based buffer overflow. The flaw is triggered via the /cgi-bin/mbox-config?method=SET&section=ptest_channel endpoint. Due to the nature of the overflow, an attacker can potentially execute arbitrary code remotely. The vulnerability has a CVSS 4.0 base score of 9.4, indicating critical severity with high impact on confidentiality, integrity, and availability. Exploit code has been made public, increasing the risk of exploitation.

Successful exploitation can lead to remote code execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device. Given the critical CVSS score and the public availability of exploit code, the risk of attack is significant. However, no confirmed active exploitation in the wild has been reported at this time.

No official patch or remediation guidance has been published by the vendor as of now. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the affected management interface to trusted networks only and monitor for suspicious activity targeting the vulnerable endpoint.