EUVD-2026-62224
GHSA-m8hp-gppg-6x6v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web interface
-
DeliverySend crafted request to /cgi-bin/mbox-config
-
ExploitOverflow stack via oversized width/height
-
ExecutionOverwrite return address in get_para_from_uri
-
ImpactExecute arbitrary code / crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Comfast CF-N1-S HTTP management service and the ability to send a request to the /cgi-bin/mbox-config CGI with attacker-controlled width or height URI parameters - no credentials, session, or user interaction are needed per the CVSS 4.0 vector (PR:N/UI:N/AT:N). The concrete prerequisite is that the mbox-config endpoint and its get_para_from_uri parsing path are exposed to the attacker's network position; the primary limiting factor is therefore management-interface exposure: if the web UI is bound only to the LAN, remote internet exploitation is prevented, and only firmware 2.6.0.1 is confirmed affected. |
| Impact | The signals are largely aligned toward high urgency: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially reachable, unauthenticated network attack, and the vendor-scored 10.0 reflects full compromise of confidentiality, integrity, and availability. Because the affected asset is network-edge infrastructure that is often internet-exposed, even a mid-sized municipal IT team in inowroclaw should treat this as urgent and hunt for exposed CF-N1-S management interfaces. That said, several tempering factors exist: no EPSS probability was supplied in the input, the CVE is not in CISA KEV (no confirmed active exploitation), and no packaged exploit is confirmed - the GitHub reference may contain a proof-of-concept but its maturity is unverified. The realistic caveat is exposure-dependent: if the mbox-config CGI is only reachable on the LAN, the AV:N rating overstates real-world reach, so verify whether the management interface is WAN-accessible before ranking this above other critical items. |
| Exploit ScenarioDerived | An attacker who can reach the device's web management interface sends a single crafted HTTP request to /cgi-bin/mbox-config with an over-long width (or height) parameter, overflowing the stack buffer in get_para_from_uri. With no authentication or user interaction required, this either crashes the CGI/device or, on the unprotected embedded target, redirects execution to attacker-supplied shellcode for remote code execution. The referenced GitHub repository may provide a working proof-of-concept, lowering the barrier to weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Remote unauthenticated stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets attackers corrupt memory by supplying oversized width/height values to the get_para_from_uri routine of the /cgi-bin/mbox-config endpoint. Because the flaw is reachable over the network with no authentication or user interaction (CVSS 4.0 base 10.0), a successful write can crash the device or achieve arbitrary code execution on the embedded firmware. It is not listed in CISA KEV and no productized exploit is confirmed, though a VulDB-referenced GitHub repository (1ChaoRen1/IOT_3) appears to document the finding.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed firmware version is cited in the source data, so remediation must rely on compensating controls. Primarily, remove the device management/HTTP interface from any untrusted or WAN-facing network and restrict access to the /cgi-bin/mbox-config endpoint to a trusted management VLAN or jump host via firewall ACLs - this blocks the remote vector at the cost of requiring on-network or VPN access for administration. Where feasible, place the device behind a reverse proxy or WAF that enforces length limits on the width and height URI parameters to reject oversized values, accepting the risk that this does not fix the underlying overflow. Monitor the vendor (Comfast) and the VulDB entry https://vuldb.com/cve/CVE-2026-76008 for a patched firmware release and apply it once published; if the device is end-of-life or exposed and unpatched, plan replacement. Do not deploy the affected firmware on internet-reachable segments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the URI parameter parser (get_para_from_uri) inside the mbox-config CGI handler of the Comfast CF-N1-S, a small-form-factor CPE/wireless access device running Linux-based embedded firmware. CWE-121 (stack-based buffer overflow) is the root-cause class: the handler copies the attacker-controlled width and height query-string parameters into a fixed-size stack buffer without validating their length, allowing the saved return address and adjacent stack frame to be overwritten. On typical MIPS/ARM embedded targets with weak or absent stack protections (no stack canaries, RWX pages, no ASLR), such overflows in a CGI process frequently translate directly into remote code execution. The single affected CPE is cpe:2.3:a:comfast:cf-n1-s:*:*:*:*:*:*:*:* covering CF-N1-S 2.6.0.1.
Know when Cf N1 S gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Unauthenticated network request to the CGI with no user interaction gives AV:N/AC:L/PR:N/UI:N; memory-corruption RCE on the device yields C:H/I:H/A:H with scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely.
Executive ViewAI
The Comfast CF-N1-S wireless device (firmware 2.6.0.1) contains a critical remote code execution vulnerability accessible without authentication or user interaction, enabling attackers to execute arbitrary code and fully compromise device firmware. Organizations deploying this hardware face immediate risk of network access compromise and operational disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: air-gap affected devices from production networks, implement network segmentation using a dedicated VLAN with ingress filtering to deny access to the /cgi-bin/mbox-config endpoint, disable remote management features if available, monitor Comfast security advisories and VulDB for patch releases, and maintain security logs for forensic review. Device replacement remains the primary remediation objective.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
An unauthenticated stack-based buffer overflow in the web management interface of the Comfast CF-N1-S (firmware 2.6.0.1)
Remote command injection in Comfast CF-N1-S firmware 2.6.0.1 allows a low-privilege authenticated attacker to execute ar
Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via th
Stack-based buffer overflow in the Comfast CF-N1-S firmware version 2.6.0.1 allows remote attackers with low-privilege w
Stack-based buffer overflow in Comfast CF-N1-S firmware 2.6.0.1 allows authenticated remote attackers to execute arbitra
Command injection in COMFAST CF-N1-S firmware 2.6.0.1 allows remote authenticated attackers to execute arbitrary OS comm
Command injection in the Comfast CF-N1-S firmware 2.6.0.1 CGI management interface allows remote low-privileged attacker
Command injection in the Comfast CF-N1-S router version 2.6.0.1 allows an authenticated remote attacker to execute arbit
Exploit-DB