Skip to main content

Comfast CF-N1-S CVE-2026-77022

| EUVDEUVD-2026-63473 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-08-20 VulDB GHSA-5pr4-rqrw-x9qc
Stack Overflow Buffer Overflow Cf N1 S
8.6
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
8.6 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

Network-accessible CGI endpoint requires low-privilege auth; scope change applies because full router compromise redirects or intercepts all downstream network traffic.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Aug 20, 2026 - 17:44 vuln.today
Severity Changed
Aug 20, 2026 - 17:22 NVD
CRITICAL HIGH
CVSS changed
Aug 20, 2026 - 17:22 NVD
9.4 (CRITICAL) 8.6 (HIGH)
CVE Published
Aug 20, 2026 - 16:45 cve.org
HIGH 8.6

DescriptionCVE.org

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component SSID Configuration. The manipulation of the argument ssid results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Stack-based buffer overflow in Comfast CF-N1-S firmware 2.6.0.1 allows authenticated remote attackers to execute arbitrary code by supplying an oversized SSID value to the device's CGI configuration endpoint. The vulnerable function sub_44B438, reachable via /cgi-bin/mbox-config?method=SET&section=ptest_ssid, performs no bounds checking on the ssid argument before copying it onto the stack. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain device credentials via default passwords or brute force
Delivery
Authenticate to CF-N1-S management interface
Exploit
Send crafted HTTP POST with oversized ssid to /cgi-bin/mbox-config
Install
Trigger stack buffer overflow in sub_44B438
C2
Overwrite return address with shellcode pointer
Execute
Execute arbitrary code on device firmware
Impact
Achieve full router compromise
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to hold a low-privilege authenticated session on the Comfast CF-N1-S management interface (CVSS PR:L), meaning valid credentials must be obtained before the buffer overflow can be triggered - unauthenticated exploitation is not supported by the available CVSS vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects a high-severity, network-exploitable flaw requiring only low privilege. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained valid credentials for the Comfast CF-N1-S management interface - whether through default credential reuse, brute force, or credential theft - sends a crafted HTTP POST request to /cgi-bin/mbox-config?method=SET&section=ptest_ssid with an oversized ssid parameter. This triggers the stack buffer overflow in sub_44B438, overwriting the return address with a payload. …
Remediation No vendor-released patch has been identified at time of analysis - monitor VulDB (https://vuldb.com/vuln/393637) and the Comfast product page for updates. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Comfast CF-N1-S devices running firmware 2.6.0.1 and document their network locations and current administrative access controls. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cf N1 S

View all
CVE-2026-77683 HIGH POC
8.6 Aug 21

Remote command injection in Comfast CF-N1-S firmware 2.6.0.1 allows a low-privilege authenticated attacker to execute ar
CVE-2026-78050 HIGH POC
8.6 Aug 22

Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via th
CVE-2026-77148 HIGH POC
8.6 Aug 20

Stack-based buffer overflow in the Comfast CF-N1-S firmware version 2.6.0.1 allows remote attackers with low-privilege w
CVE-2026-76008 CRITICAL
10.0 Aug 19

Remote unauthenticated stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets attack
CVE-2026-19976 LOW POC
2.0 Aug 17

Command injection in COMFAST CF-N1-S firmware 2.6.0.1 allows remote authenticated attackers to execute arbitrary OS comm
CVE-2026-77004 LOW POC
2.1 Aug 20

Command injection in the Comfast CF-N1-S firmware 2.6.0.1 CGI management interface allows remote low-privileged attacker
CVE-2026-6799 LOW POC
2.1 Apr 21

Command injection in the Comfast CF-N1-S router version 2.6.0.1 allows an authenticated remote attacker to execute arbit

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Stack Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Share

CVE-2026-77022 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy