Comfast CF-N1-S CVE-2026-77022

Exploitation requires the attacker to hold a low-privilege authenticated session on the Comfast CF-N1-S management interface (CVSS PR:L), meaning valid credentials must be obtained before the buffer overflow can be triggered - unauthenticated exploitation is not supported by the available CVSS vector. The vulnerable endpoint /cgi-bin/mbox-config?method=SET&section=ptest_ssid must be network-reachable (AV:N), so devices with management interfaces exposed to untrusted or internet-facing networks are at greatest risk. No non-default configuration requirement has been identified beyond the device being operational and the CGI interface enabled, which is the default state. Limiting factors: the authentication requirement reduces fully opportunistic exploitation; however, Comfast consumer routers commonly retain default credentials, and the low-privilege threshold means standard user accounts suffice - administrator rights are not required.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects a high-severity, network-exploitable flaw requiring only low privilege. The E:P supplemental metric confirms publicly available exploit code, which materially lowers the skill threshold for exploitation. The vulnerability is not currently listed in CISA KEV, meaning confirmed active exploitation in campaigns has not been established - but the gap between POC release and KEV listing is often measured in days to weeks for router-class vulnerabilities. PR:L is a meaningful but limited barrier: consumer routers frequently ship with default credentials or weak authentication, effectively reducing this prerequisite in many real deployments. The SC:H/SI:H/SA:H scope metrics indicate that successful exploitation compromises not just the device but the network segment it serves, amplifying the blast radius well beyond the device itself. No patch is available, making isolation and access restriction the only current mitigations. Overall real-world risk is high for any network that relies on this device and exposes its management interface to untrusted traffic.

An attacker who has obtained valid credentials for the Comfast CF-N1-S management interface - whether through default credential reuse, brute force, or credential theft - sends a crafted HTTP POST request to /cgi-bin/mbox-config?method=SET&section=ptest_ssid with an oversized ssid parameter. This triggers the stack buffer overflow in sub_44B438, overwriting the return address with a payload. A public POC is available at https://github.com/AdminSafe/CVE/issues/5, reducing exploitation to a script-kiddie-level task.