Comfast CF-N1-S EUVD-2026-63884

Exploitation requires low-privilege authenticated access to the Comfast CF-N1-S web administration interface - the CVSS 4.0 PR:L metric confirms some credential level is mandatory, though the exact privilege tier (e.g., read-only user vs. administrator) is not specified in available data and should be verified against device documentation. The vulnerable functionality is the NTP timezone configuration feature exposed at /cgi-bin/mbox-config?method=SET&section=ntp_timezone, meaning that endpoint must be reachable by the attacker's session. The device must be accessible over the network (AV:N), and no victim user interaction is required. Exploitation is bounded to confirmed firmware version 2.6.0.1; other versions are potentially affected per the wildcard CPE but are not individually confirmed. Devices isolated behind NAT with no external management access are not directly reachable and are therefore significantly less exposed.

The CVSS 4.0 base score of 8.6 accurately reflects a high-severity network-exploitable flaw: AV:N (reachable over the network), AC:L (no special timing or conditions), AT:N (no attack prerequisites), PR:L (low-privilege credentials required), and UI:N (no user interaction needed), with full H ratings across all six impact dimensions including subsequent-system scope. The PR:L metric is the principal mitigating factor versus a fully unauthenticated flaw; however, default or weak credentials on embedded networking devices are frequently present in practice, which effectively elevates real-world exploitability. The E:P supplemental modifier in the provided vector confirms a public proof-of-concept exists, which is corroborated by the GitHub reference. No CISA KEV listing appears in the source data, so confirmed active exploitation cannot be stated, but the combination of a network-accessible endpoint, low complexity, and public PoC makes this a credible priority for any deployment. EPSS data is absent from available intelligence - this gap should be checked against current NVD feeds before making triage decisions. No conflicting signals were identified between the CVSS vector and the vulnerability description.

An attacker who has obtained low-privilege credentials to the Comfast CF-N1-S web interface - through credential stuffing, default credentials, or prior recon - sends a crafted HTTP request to /cgi-bin/mbox-config?method=SET&section=ntp_timezone&timestr=UTC%3Bwhoami or equivalent, injecting a shell command via the unsanitized timestr parameter. The firmware's system() call executes the injected command in the context of the web server process, potentially as root given embedded device privilege models. A public proof-of-concept demonstrating this technique is available at https://github.com/AdminSafe/CVE/issues/8, enabling exploitation with minimal attacker skill.