Comfast CF-N1-S EUVD-2026-64604

Exploitation requires network access to the Comfast CF-N1-S web management interface and a low-privileged authenticated session, as indicated by PR:L in the CVSS 4.0 vector. The specific trigger is sending an oversized value for the timestr or ntp_client_enabled parameters to the /cgi-bin/mbox-config?method=SET&section=ntp_timezone CGI endpoint. No non-default device configuration is required beyond the management interface being reachable from the attacker's network position. What limits exploitation is the low-privilege authentication requirement - attackers must hold valid credentials; however, consumer and SMB networking devices commonly ship with default or easily guessable credentials, which may effectively eliminate this barrier. No user interaction is required (UI:N) once authenticated access is established.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity vulnerability requiring only low-privileged access - a combination that significantly lowers the practical exploitation barrier. The E:P supplemental metric confirms public exploit code exists on GitHub. The VC/VI/VA and SC/SI/SA metrics are all rated High, signaling potential for complete device takeover with cascading impact on the network the device routes or manages, making this a real operational priority wherever these devices are deployed. No CISA KEV listing was identified, so active exploitation is not confirmed at time of analysis; however, the public POC substantially raises the likelihood of opportunistic attacks. No EPSS data was provided, preventing quantitative probability comparison. The CPE wildcard version field introduces uncertainty about how many firmware releases are affected beyond 2.6.0.1. The primary real-world limiting factor is the PR:L requirement - attackers must hold valid low-privileged credentials - though consumer networking devices frequently ship with default or easily guessable credentials, which may effectively eliminate this barrier in practice.

An attacker who has obtained low-privileged credentials to the Comfast CF-N1-S web management interface - potentially via default credentials or credential stuffing - sends a crafted HTTP request to /cgi-bin/mbox-config?method=SET&section=ntp_timezone with an oversized timestr or ntp_client_enabled parameter value. This overflows the stack buffer in function sub_41AD7C, enabling the attacker to overwrite the saved return address and redirect execution to attacker-controlled code, achieving remote code execution on the device. A public proof-of-concept is available on GitHub (https://github.com/AdminSafe/CVE/issues/9), substantially reducing the technical skill required to carry out this attack.