COMFAST CF-N1-S CVE-2026-75094

Exploitation requires the attacker to authenticate to the router's management interface with high-privilege (administrator-level) credentials prior to issuing the malicious request, as confirmed by the CVSS PR:H metric. The specific vulnerable functionality is the SET method on the ptest_ssid section of the /cgi-bin/mbox-config CGI endpoint - a feature associated with SSID penetration testing or wireless network configuration. If the device's remote management interface is exposed over the WAN, exploitation is possible from the internet by any attacker with valid admin credentials; if restricted to LAN-only access, the attack is limited to network-adjacent authenticated users. The primary exploitation limiter is obtaining administrator credentials; devices using default or weak passwords effectively reduce this to a trivial prerequisite.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H with an 8.5 score accurately captures the threat profile: network reachable, low attack complexity, no user interaction, but requiring high-privilege authentication. The full-high impact across both vulnerable and subsequent systems indicates a scope change - full router control potentially pivots into downstream network traffic manipulation. The E:P exploit status confirms a publicly available PoC, meaningfully lowering the skill threshold for exploitation. However, the PR:H requirement is the critical limiting factor: an attacker must first obtain valid administrator credentials. In practice, small-business and home routers of this class are routinely deployed with default or weak credentials, which effectively collapses this barrier - even a mid-sized municipal IT team in walbrzych managing a distributed branch network should treat this as urgent if COMFAST CF-N1-S units are in inventory. No EPSS score was available in the supplied data, so exploitation probability cannot be numerically quantified. KEV listing is absent, indicating no confirmed broad active exploitation at time of analysis, but the published PoC makes opportunistic scanning a realistic near-term risk.

An attacker who has acquired administrator credentials to the COMFAST CF-N1-S - whether through default credential exploitation, credential stuffing, or prior compromise - sends a crafted HTTP request to /cgi-bin/mbox-config?method=SET&section=ptest_ssid with an ssid value containing shell metacharacters such as ; id # or backtick sequences. Function sub_44B438 passes the unsanitized value directly to a shell command, executing the injected payload with CGI process privileges and granting the attacker arbitrary OS command execution and full device control. A public PoC is available at https://github.com/1ChaoRen1/IOT_1, reducing the exploitation skill requirement significantly.