Comfast CF-N1-S CVE-2026-77148

Exploitation requires authenticated access to the Comfast CF-N1-S web management HTTP interface - the CVSS 4.0 PR:L metric confirms that low-privilege credentials are sufficient; unauthenticated exploitation is not supported by the available data. The specific endpoint /cgi-bin/mbox-config?method=SET&section=ptest_channel must be reachable by the attacker, meaning the device's web management port must be network-accessible from the attacker's position. No user interaction beyond the attacker's own HTTP request is required (UI:N). Exploitation is limited by the credential requirement: devices with strong, unique passwords are substantially less exposed than those with default or weak credentials. No specific non-default configuration flag or feature toggle is identified in the description as a prerequisite beyond the web management service being active, which is the default state for this class of device.

The CVSS 4.0 score of 8.6 reflects high impact across all three pillars - confidentiality, integrity, and availability - on both the vulnerable system and subsequent systems (SC:H/SI:H/SA:H), acknowledging that a compromised router affects all downstream network traffic and connected devices. The PR:L metric is a meaningful constraint: exploitation requires at least low-privilege credentials to the web management interface, which in practice limits opportunistic mass exploitation but does not stop targeted attacks, credential-stuffing, or insiders. The AC:L and AT:N metrics confirm no special race conditions or environmental prerequisites beyond authentication. The E:P modifier in the provided CVSS 4.0 supplemental data confirms POC-level exploit code is publicly accessible, which substantially lowers the skill bar. No EPSS score was provided in the available intelligence, limiting quantitative probability estimates. The absence of a CISA KEV entry suggests active widespread exploitation has not yet been confirmed, but the combination of a network-accessible vector, low complexity, and public POC makes this a credible near-term exploitation candidate, particularly for devices with default or weak credentials exposed to the internet.

An attacker who has obtained low-privilege credentials to the Comfast CF-N1-S web management interface - through default credentials, credential stuffing, or prior access - sends a crafted HTTP POST request to /cgi-bin/mbox-config?method=SET&section=ptest_channel with an oversized ptest_channel value. The function sub_44B50C copies this input into a fixed-size stack buffer without bounds checking, overwriting the saved return address and enabling control-flow redirection to attacker-controlled shellcode. The publicly available POC on GitHub (https://github.com/AdminSafe/CVE/issues/7) provides a ready exploit template, reducing attacker skill requirements substantially.