This vulnerability affects Comfast CF-N1-S version 2.6.0.1 and involves command injection via the timestr parameter in the system function of the /cgi-bin/mbox-config?method=SET&section=ntp_timezone endpoint. An attacker can remotely supply crafted input to execute arbitrary commands on the device. The CVSS 4.0 base score is 9.4, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, availability, and security requirements. Public exploit code has been released, but no official patch or fix has been documented.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to full compromise of the system. The vulnerability impacts confidentiality, integrity, and availability of the device and its data. Given the public availability of exploit code, the risk of active exploitation is elevated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable endpoint and consider network-level controls to limit exposure. Monitor for any updates from Comfast regarding patches or mitigations.