Skip to main content

COMFAST CF-N1-S EUVDEUVD-2026-60036

| CVE-2026-19976 LOW
Command Injection (CWE-77)
2026-08-17 VulDB GHSA-24vp-g788-qg25
Command Injection Cf N1 S
2.0
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.0 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.7 MEDIUM

Network-reachable CGI endpoint (AV:N, AC:L) but requires admin credentials (PR:H); impacts are partial across C/I/A consistent with command injection on embedded firmware without confirmed full root.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

4
Severity Changed
Aug 17, 2026 - 03:22 NVD
MEDIUM LOW
CVSS changed
Aug 17, 2026 - 03:22 NVD
5.1 (MEDIUM) 2.0 (LOW)
Analysis Generated
Aug 17, 2026 - 03:14 vuln.today
CVE Published
Aug 17, 2026 - 02:45 cve.org
MEDIUM 5.1

DescriptionCVE.org

A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET&section=ptest_macaddress. Such manipulation of the argument macaddress leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Command injection in COMFAST CF-N1-S firmware 2.6.0.1 allows remote authenticated attackers to execute arbitrary OS commands via the macaddress parameter of the /cgi-bin/mbox-config CGI endpoint. The vulnerable function sub_44A968 fails to sanitize input passed through the ptest_macaddress section before passing it to a system-level command. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain admin credentials via phishing or credential reuse
Delivery
Reach device web management interface
Exploit
Send crafted POST to /cgi-bin/mbox-config with injected macaddress value
Execution
sub_44A968 passes unsanitized input to system call
Impact
Arbitrary OS command executed on device
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires valid administrative credentials to the COMFAST CF-N1-S web management interface (PR:H per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.1 (Medium) reflects authenticated access (PR:H) as a significant barrier to exploitation, which meaningfully constrains the real-world attack surface compared to unauthenticated variants. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with valid administrative credentials to the COMFAST CF-N1-S web interface sends a crafted HTTP request to /cgi-bin/mbox-config?method=SET&section=ptest_macaddress with a macaddress parameter containing injected shell metacharacters (e.g., ; command ;). The firmware's sub_44A968 function passes this unsanitized value to a system call, executing the injected command in the device's runtime context. …
Remediation No vendor-released patch has been identified at time of analysis, and the vendor did not respond to the responsible disclosure. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cf N1 S

View all
CVE-2026-77683 HIGH POC
8.6 Aug 21

Remote command injection in Comfast CF-N1-S firmware 2.6.0.1 allows a low-privilege authenticated attacker to execute ar
CVE-2026-78050 HIGH POC
8.6 Aug 22

Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via th
CVE-2026-77148 HIGH POC
8.6 Aug 20

Stack-based buffer overflow in the Comfast CF-N1-S firmware version 2.6.0.1 allows remote attackers with low-privilege w
CVE-2026-77022 HIGH POC
8.6 Aug 20

Stack-based buffer overflow in Comfast CF-N1-S firmware 2.6.0.1 allows authenticated remote attackers to execute arbitra
CVE-2026-76008 CRITICAL
10.0 Aug 19

Remote unauthenticated stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets attack
CVE-2026-77004 LOW POC
2.1 Aug 20

Command injection in the Comfast CF-N1-S firmware 2.6.0.1 CGI management interface allows remote low-privileged attacker
CVE-2026-6799 LOW POC
2.1 Apr 21

Command injection in the Comfast CF-N1-S router version 2.6.0.1 allows an authenticated remote attacker to execute arbit

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

EUVD-2026-60036 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy