EUVD-2026-60566
GHSA-qp57-ch36-236j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H because admin credentials are required; S:C because full router control enables downstream network traffic manipulation beyond the device itself.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET§ion=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
AnalysisAI
OS command injection in the COMFAST CF-N1-S 2.6.0.1 router's CGI interface enables network-accessible, authenticated attackers to execute arbitrary operating system commands by manipulating the ssid parameter at the /cgi-bin/mbox-config?method=SET§ion=ptest_ssid endpoint. The underlying function sub_44B438 passes unsanitized user input directly to a shell, resulting in full device compromise with scope impact extending to downstream network systems. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to authenticate to the router's management interface with high-privilege (administrator-level) credentials prior to issuing the malicious request, as confirmed by the CVSS PR:H metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H with an 8.5 score accurately captures the threat profile: network reachable, low attack complexity, no user interaction, but requiring high-privilege authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has acquired administrator credentials to the COMFAST CF-N1-S - whether through default credential exploitation, credential stuffing, or prior compromise - sends a crafted HTTP request to `/cgi-bin/mbox-config?method=SET§ion=ptest_ssid` with an `ssid` value containing shell metacharacters such as `; id #` or backtick sequences. Function `sub_44B438` passes the unsanitized value directly to a shell command, executing the injected payload with CGI process privileges and granting the attacker arbitrary OS command execution and full device control. … |
| Remediation | No vendor-released patch has been identified at time of analysis for COMFAST CF-N1-S firmware 2.6.0.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all COMFAST CF-N1-S routers in your network and identify systems running version 2.6.0.1, then immediately restrict network access to the /cgi-bin/mbox-config endpoint using firewall rules to prevent exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today