A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-78050 is a critical stack-based buffer overflow vulnerability in Comfast CF-N1-S version 2.6.0.1. It affects the Web Management component, specifically the function sub_41AD7C in the /cgi-bin/mbox-config?method=SET§ion=ntp_timezone endpoint. The vulnerability arises from improper handling of the timestr/ntp_client_enabled argument, allowing remote attackers to trigger a buffer overflow. Exploit code has been publicly disclosed, but no confirmed in-the-wild exploitation is reported.
CVE-2026-77683 is a critical command injection vulnerability in Comfast CF-N1-S version 2.6.0.1. The flaw exists in the system function of the /cgi-bin/mbox-config?method=SET§ion=ntp_timezone endpoint, where manipulation of the 'timestr' argument allows remote attackers to execute arbitrary commands. Public exploit code is available, increasing the risk of exploitation.
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET§ion=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
CVE-2026-77022 is a critical stack-based buffer overflow vulnerability in the Comfast CF-N1-S device version 2.6.0.1. The flaw exists in the SSID Configuration component, specifically in the function sub_44B438 accessed via the /cgi-bin/mbox-config?method=SET§ion=ptest_ssid endpoint. Remote attackers can exploit this vulnerability by manipulating the ssid argument, potentially leading to severe impacts. Public exploit code has been released, increasing the risk of attacks.
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET§ion=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.
CVE-2026-76008 is a critical stack-based buffer overflow vulnerability in Comfast CF-N1-S version 2.6.0.1. It affects the get_para_from_uri function in the /cgi-bin/mbox-config component, specifically in URI parameter parsing. The vulnerability is triggered by manipulating the width/height argument remotely, potentially allowing an attacker to execute arbitrary code or cause a denial of service.
CVE-2026-75094 is a critical OS command injection vulnerability in the COMFAST CF-N1-S device version 2.6.0.1. The flaw exists in the CGI interface component, specifically in the sub_44B438 function handling the /cgi-bin/mbox-config?method=SET§ion=ptest_ssid endpoint. An attacker can remotely exploit this by manipulating the ssid argument to execute arbitrary OS commands. Exploit code has been published, increasing the risk of exploitation.
CVE-2026-19976 is a command injection vulnerability in the COMFAST CF-N1-S device version 2.6.0.1. The flaw exists in the function sub_44A968 within the /cgi-bin/mbox-config endpoint, where manipulation of the macaddress parameter can lead to remote command execution. The vulnerability has been publicly disclosed, and exploit code may be available. The vendor has not responded to disclosure requests, and no official patch or remediation guidance is currently available. The CVSS 4.0 base score is 5.1, indicating a medium severity level.
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8. This issue affects the function system of the file /cgi-bin/mbox-config?section=ping_config of the component API Endpoint. This manipulation of the argument destination causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-6799 is a command injection vulnerability in Comfast CF-N1-S version 2.6.0.1. It affects an unknown functionality within the /cgi-bin/mbox-config? method=SET§ion=ping_config endpoint, where manipulation of the 'destination' argument can lead to remote command injection. The vulnerability allows an attacker to execute arbitrary commands remotely without user interaction. The vendor has not responded to the disclosure, and no official patch or mitigation guidance is currently available. The CVSS 4.0 base score is 5.
A vulnerability was determined in Comfast CF-AC100 2.6.0.8. Affected is an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=update_interface_png. This manipulation causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-4467 is a command injection vulnerability affecting Comfast CF-AC100 version 2.6.0.8. The flaw exists in the /cgi-bin/mbox-config endpoint, specifically when handling the 'method=SET§ion=wireless_device_dissoc' parameter. This vulnerability allows an unauthenticated remote attacker with high privileges to execute arbitrary commands on the device. Although the vendor was notified, no patch or response has been provided. The CVSS 4.0 score is 5.1, indicating medium severity.
CVE-2026-4466 is a command injection vulnerability in the Comfast CF-AC100 wireless device running firmware version 2.6.0.8. The flaw exists in the /cgi-bin/mbox-config endpoint, specifically when setting the ntp_timezone parameter, allowing remote attackers to execute arbitrary commands. Exploitation does not require user interaction but does require high privileges, limiting attack vectors. The vendor has not responded to the disclosure, and no patches are currently available. The CVSS 4.0 base score is 5.1, indicating medium severity.
A vulnerability was detected in Comfast CF-AC100 2.6.0.8. This affects the function sub_44AC14 of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the component Request Path Handler. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A flaw has been found in Comfast CF-E7 2.6.0.9. This affects the function sub_441CF4 of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the component webmggnt. Executing a manipulation of the argument destination can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component webmggnt. Performing a manipulation of the argument timestr results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was identified in Comfast CF-E4 2.6.0.1. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component HTTP POST Request Handler. Such manipulation of the argument timestr leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.