Skip to main content

Comfast CF-N1-S CVE-2026-77683

| EUVDEUVD-2026-63884 HIGH
Command Injection (CWE-77)
2026-08-21 VulDB GHSA-hh37-xhg2-x62w
Command Injection Cf N1 S
8.6
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
8.6 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

Network-accessible CGI endpoint with full device OS takeover constitutes scope change; PR:L per CVSS 4.0 alignment as low-privilege authentication is required.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

6
Analysis Updated
Aug 21, 2026 - 11:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 21, 2026 - 11:22 vuln.today
cvss_changed
Severity Changed
Aug 21, 2026 - 11:22 NVD
CRITICAL HIGH
CVSS changed
Aug 21, 2026 - 11:22 NVD
9.4 (CRITICAL) 8.6 (HIGH)
Analysis Generated
Aug 21, 2026 - 11:00 vuln.today
CVE Published
Aug 21, 2026 - 10:15 cve.org
CRITICAL 9.4

DescriptionCVE.org

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Remote command injection in Comfast CF-N1-S firmware 2.6.0.1 allows a low-privilege authenticated attacker to execute arbitrary OS commands via the NTP timezone configuration CGI endpoint by supplying unsanitized shell metacharacters in the timestr parameter. The CVSS 4.0 vector scores 8.6 with full high-impact ratings across confidentiality, integrity, and availability on both the vulnerable device and subsequent systems, reflecting potential for complete device takeover. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege device credentials
Delivery
Send crafted HTTP GET/POST to /cgi-bin/mbox-config NTP endpoint
Exploit
Inject shell metacharacters in timestr parameter
Execution
Firmware passes unsanitized input to system()
Persist
Execute arbitrary OS commands on device
Impact
Full device compromise
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires low-privilege authenticated access to the Comfast CF-N1-S web administration interface - the CVSS 4.0 PR:L metric confirms some credential level is mandatory, though the exact privilege tier (e.g., read-only user vs. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.6 accurately reflects a high-severity network-exploitable flaw: AV:N (reachable over the network), AC:L (no special timing or conditions), AT:N (no attack prerequisites), PR:L (low-privilege credentials required), and UI:N (no user interaction needed), with full H ratings across all six impact dimensions including subsequent-system scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained low-privilege credentials to the Comfast CF-N1-S web interface - through credential stuffing, default credentials, or prior recon - sends a crafted HTTP request to `/cgi-bin/mbox-config?method=SET&section=ntp_timezone&timestr=UTC%3Bwhoami` or equivalent, injecting a shell command via the unsanitized `timestr` parameter. The firmware's `system()` call executes the injected command in the context of the web server process, potentially as root given embedded device privilege models. …
Remediation No vendor-released patch has been identified at the time of this analysis; no fixed firmware version appears in VulDB, ENISA EUVD-2026-63884, or any referenced source. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Comfast CF-N1-S devices and identify which are running firmware version 2.6.0.1. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cf N1 S

View all
CVE-2026-78050 HIGH POC
8.6 Aug 22

Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via th
CVE-2026-77148 HIGH POC
8.6 Aug 20

Stack-based buffer overflow in the Comfast CF-N1-S firmware version 2.6.0.1 allows remote attackers with low-privilege w
CVE-2026-77022 HIGH POC
8.6 Aug 20

Stack-based buffer overflow in Comfast CF-N1-S firmware 2.6.0.1 allows authenticated remote attackers to execute arbitra
CVE-2026-76008 CRITICAL
10.0 Aug 19

Remote unauthenticated stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets attack
CVE-2026-19976 LOW POC
2.0 Aug 17

Command injection in COMFAST CF-N1-S firmware 2.6.0.1 allows remote authenticated attackers to execute arbitrary OS comm
CVE-2026-77004 LOW POC
2.1 Aug 20

Command injection in the Comfast CF-N1-S firmware 2.6.0.1 CGI management interface allows remote low-privileged attacker
CVE-2026-6799 LOW POC
2.1 Apr 21

Command injection in the Comfast CF-N1-S router version 2.6.0.1 allows an authenticated remote attacker to execute arbit

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

CVE-2026-77683 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy