COMFAST CF-N1-S CVE-2026-19976

Exploitation requires valid administrative credentials to the COMFAST CF-N1-S web management interface (PR:H per CVSS 4.0 vector). The attacker must be able to reach the /cgi-bin/mbox-config CGI endpoint over the network (AV:N). No special non-default configuration is required beyond having admin access - the ptest_macaddress section is part of the standard CGI interface. Limiting factors: the PR:H requirement means an attacker without existing admin credentials cannot exploit this without a separate credential-theft step; the device management interface is typically not exposed to the public internet in properly segmented networks, which substantially limits internet-scale exploitation. The attack does not require user interaction.

The CVSS 4.0 score of 5.1 (Medium) reflects authenticated access (PR:H) as a significant barrier to exploitation, which meaningfully constrains the real-world attack surface compared to unauthenticated variants. The EPSS score is not provided in the available data, which is a gap in the signal picture. No KEV listing exists, so active exploitation is not confirmed by CISA. However, a public PoC (E:P in the CVSS 4.0 vector) is present, lowering the skill bar for any attacker who already holds admin credentials. The confidentiality, integrity, and availability impacts are rated Low across both vulnerable-system and subsequent-system metrics, suggesting partial rather than full device compromise - though command injection on embedded firmware can realistically achieve full root access depending on the runtime context, so this rating may understate actual impact. Even a mid-sized municipal IT team in kalisz operating COMFAST devices on their network perimeter should treat any authenticated command injection on a device with no vendor patch as a replacement priority, not just a configuration task. The vendor's non-response to disclosure removes any confidence in a future patch and is a material risk factor.

An attacker with valid administrative credentials to the COMFAST CF-N1-S web interface sends a crafted HTTP request to /cgi-bin/mbox-config?method=SET&section=ptest_macaddress with a macaddress parameter containing injected shell metacharacters (e.g., ; command ;). The firmware's sub_44A968 function passes this unsanitized value to a system call, executing the injected command in the device's runtime context. A public PDF PoC demonstrating this technique is available on GitHub.