Is there a public PoC exploit available for CVE-2026-6799?

Yes, a public proof-of-concept exploit is available for CVE-2026-6799. Prioritise patching immediately. EPSS: 0.8%.

Comfast CF-N1-S CVE-2026-6799

Q: What is the CVSS score of CVE-2026-6799?

CVE-2026-6799 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-24503 LOW

Command Injection (CWE-77)

2026-04-21 VulDB

GHSA-3h35-4gph-x5jr

Command Injection Cf N1 S Comfast

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible CGI endpoint (AV:N, AC:L) requires authenticated access (PR:L); limited impact on a constrained router OS warrants C:L/I:L/A:L with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:36 vuln.today

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 21, 2026 - 22:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 21, 2026 - 22:16 euvd

EUVD-2026-24503

CVE Published

Apr 21, 2026 - 21:00 nvd

LOW 2.1

DescriptionCVE.org

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is some unknown functionality of the file /cgi-bin/mbox-config?method=SET&section=ping_config of the component Endpoint. Performing a manipulation of the argument destination results in command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Command injection in the Comfast CF-N1-S router version 2.6.0.1 allows an authenticated remote attacker to execute arbitrary OS commands by manipulating the destination parameter of the /cgi-bin/mbox-config?method=SET&section=ping_config CGI endpoint. A public exploit has been released on GitHub. No vendor patch exists - the vendor was contacted prior to disclosure and did not respond. Despite the public POC, EPSS sits at 0.84% and SSVC classifies exploitation as none with partial technical impact, suggesting limited real-world uptake at time of analysis.

Technical ContextAI

The affected component is a CGI endpoint (/cgi-bin/mbox-config) on the Comfast CF-N1-S router (CPE: cpe:2.3:a:comfast:cf-n1-s:*:*:*:*:*:*:*:*), firmware version 2.6.0.1. The endpoint accepts a section=ping_config method and a destination argument, which is passed to an OS-level ping command without adequate sanitization. CWE-77 (Improper Neutralization of Special Elements used in an OS Command - Command Injection) describes the root cause: shell metacharacters in the destination value are interpreted by the underlying OS shell, allowing injected commands to execute in the security context of the web server or router process. The wildcard version in the CPE string suggests NVD has not independently confirmed whether versions other than 2.6.0.1 are affected.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to the researcher's pre-disclosure contact. As compensating controls: restrict access to the router's web administration interface to trusted internal network segments only, blocking external access to the management port (typically TCP 80/443) at the network perimeter - this eliminates the network attack vector at the cost of remote administration capability. Enforce strong, unique credentials on the router admin account to raise the bar above the PR:L authentication requirement; default credentials are a common enabler for this class of vulnerability. Where feasible, segment the device behind a firewall or VLAN that limits lateral movement if the device is compromised. Monitor VulDB entry https://vuldb.com/vuln/358492 and NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-6799 for any future vendor patch release. Consider replacing the device with a supported alternative given the vendor's lack of responsiveness.