Threats affecting pkg:github/comfast/CF-N1-S

CVE-2026-76008 is a critical stack-based buffer overflow vulnerability in Comfast CF-N1-S version 2.6.0.1. It affects the get_para_from_uri function in the /cgi-bin/mbox-config component, specifically in URI parameter parsing. The vulnerability is triggered by manipulating the width/height argument remotely, potentially allowing an attacker to execute arbitrary code or cause a denial of service.

CVE-2026-6799 is a command injection vulnerability in Comfast CF-N1-S version 2.6.0.1. It affects an unknown functionality within the /cgi-bin/mbox-config? method=SET&section=ping_config endpoint, where manipulation of the 'destination' argument can lead to remote command injection. The vulnerability allows an attacker to execute arbitrary commands remotely without user interaction. The vendor has not responded to the disclosure, and no official patch or mitigation guidance is currently available. The CVSS 4.0 base score is 5.