EUVD-2026-83730
GHSA-w3j5-9v4x-w7pw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web management interface
-
DeliverySend crafted URI to /cgi-bin/mbox-config
-
ExploitOverflow stack buffer in get_css_path_from_uri
-
ExecutionHijack control flow / execute code
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the device's Web Management Interface and the ability to send a crafted request to the /cgi-bin/mbox-config CGI endpoint; no authentication, no user interaction, and no special configuration is stated as necessary (the interface is a default component). Practical limits: the attacker must be able to route to the management interface - internet exposure is not guaranteed since these devices are commonly behind the LAN, so realistic attack surface is largely local network or WAN-exposed management panels. Reliable code execution (versus a crash) depends on device memory-protection specifics; only firmware 2.6.0.1 of the Comfast CF-N1-S is named affected. |
| Impact | Signals conflict between raw score and real-world footprint. The vendor CVSS 4.0 vector is a maximal 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with all vulnerable AND subsequent-system impacts High), which overstates the case: this is a single embedded networking device, so subsequent-system metrics SC/SI/SA:H are not justified - there is no scope change propagating to a separate system. My independent read is CVSS 3.1 ~9.8 (S:U, C/I/A:H) / CVSS 4.0 ~9.3 with SC/SI/SA reduced to N. The technical severity is nonetheless genuinely high: an unauthenticated, network-reachable stack buffer overflow in a CGI handler is a classic path to remote code execution or crash on the device. Exploitation signal: publicly available exploit code exists (GitHub AdminSafe/CVE issue #12) - but this is NOT active exploitation. There is no CISA KEV listing and no EPSS score provided. The source is VulDB, which mass-publishes low-prevalence embedded/IoT device flaws with minimal corroboration (no vendor advisory, no patch reference in the data). Net: technically a critical unauth RCE-class bug, but real-world priority is tempered by the obscure, low-deployment product. Prioritize only if Comfast CF-N1-S devices are actually in your environment. |
| Exploit ScenarioDerived | An attacker with network reach to a Comfast CF-N1-S web management interface sends a crafted request to /cgi-bin/mbox-config whose URI is parsed by get_css_path_from_uri, overflowing a stack buffer. With no authentication or user interaction required (PR:N/UI:N), this can corrupt the stack to crash the service or execute attacker-controlled code on the device. Public exploit code has been disclosed (GitHub AdminSafe/CVE issue #12), lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
An unauthenticated stack-based buffer overflow in the web management interface of the Comfast CF-N1-S (firmware 2.6.0.1) allows a remote attacker to corrupt memory and potentially achieve arbitrary code execution or crash the device by sending a crafted request to the /cgi-bin/mbox-config CGI endpoint. The flaw resides in the get_css_path_from_uri function, which fails to bound-check attacker-supplied input before copying it onto the stack; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact across both the vulnerable system and subsequent systems) reflects a maximum 10.0 score, and our independent reassessment under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) likewise rates it critical. Publicly available exploit code exists (a proof-of-concept was disclosed via a public GitHub issue referenced by VulDB), though there is no confirmed active exploitation (no CISA KEV listing); practical exploitation is constrained by whether the management panel is reachable, since these devices are typically deployed behind a LAN, and reliable code execution versus a simple crash depends on the target's memory-protection configuration.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must start with exposure reduction: immediately remove the CF-N1-S management interface from untrusted networks by disabling WAN-side remote administration and placing the device behind a firewall that blocks inbound TCP access to the web management port, then restrict HTTP/HTTPS management access to a trusted administration VLAN or a small allow-list of source addresses (trade-off: remote troubleshooting now requires a jump host or VPN). Where the management plane cannot be isolated, block or reject requests to the /cgi-bin/mbox-config CGI path at the reverse proxy or WAF layer (trade-off: an in-path filter must be maintained and can be bypassed by alternate path encodings if not carefully normalized). Because exploit code is publicly available, prioritize inventorying and quarantining any internet-exposed CF-N1-S units, monitor device logs for anomalous POST/GET requests to /cgi-bin/mbox-config and unexpected reboots that may indicate failed exploit attempts, and contact Comfast support to request a fixed firmware image - consulting the VulDB advisory (https://vuldb.com/vuln/407952), the ENISA EUVD entry (EUVD-2026-83730), and the public PoC (https://github.com/AdminSafe/CVE/issues/12) for updated fixed-version guidance. If the device's management functions are not required, consider decommissioning or replacing the unit, since an unpatched memory-corruption flaw in an internet-reachable CGI handler cannot be fully mitigated by configuration alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-121 stack-based buffer overflow in the CGI handler /cgi-bin/mbox-config of the Comfast CF-N1-S wireless router/web management interface, specifically inside the function get_css_path_from_uri. The routine processes a URI-derived path without validating its length, copying the value into a fixed-size stack buffer; an oversized input overwrites adjacent stack memory, including saved registers and the return address, which can redirect execution flow. Because the sink is a CGI binary reachable over HTTP on the management interface, no authentication, user interaction, or special configuration is required per the assessed vector (PR:N, UI:N, AV:N), and the attacker only needs network reachability to the endpoint. CPE data (cpe:2.3:a:comfast:cf-n1-s) confirms the affected product family, and the ENISA EUVD entry (EUVD-2026-83730) and VulDB record both scope the issue to firmware version 2.6.0.1. No CWE-121-adjacent mitigation such as stack canaries, ASLR, or non-executable stack is stated as effective for this build, so exploitability in practice hinges on the device's binary hardening.
Know when Cf N1 S gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Unauthenticated network-reachable stack overflow in a CGI handler yields full device compromise, so PR:N/AC:L with C/I/A:H; scope unchanged as impact stays within the single device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Technical POC Analysis
The bug is a stack-based buffer overflow, CWE-121.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
The Comfast CF-N1-S (firmware 2.6.0.1) web management interface is affected by a critical unauthenticated stack-based buffer overflow (CVE-2026-94003) that could allow a remote attacker to execute arbitrary code or crash the device. Publicly available exploit code exists, though no confirmed active exploitation has been observed. Organizations using this device should urgently assess exposure, as a successful exploit could lead to full device compromise and subsequent network intrusion.
No vendor-released patch identified at time of analysis. Interim mitigations include: immediately disabling remote management and restricting web interface access to trusted internal networks only; blocking or monitoring access to the /cgi-bin/mbox-config endpoint; isolating affected devices on separate VLANs; deploying virtual patching via WAF/IPS to detect and block exploit attempts; and monitoring for unusual device behavior or crashes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote command injection in Comfast CF-N1-S firmware 2.6.0.1 allows a low-privilege authenticated attacker to execute ar
Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via th
Stack-based buffer overflow in the Comfast CF-N1-S firmware version 2.6.0.1 allows remote attackers with low-privilege w
Stack-based buffer overflow in Comfast CF-N1-S firmware 2.6.0.1 allows authenticated remote attackers to execute arbitra
Remote unauthenticated stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets attack
Command injection in COMFAST CF-N1-S firmware 2.6.0.1 allows remote authenticated attackers to execute arbitrary OS comm
Command injection in the Comfast CF-N1-S firmware 2.6.0.1 CGI management interface allows remote low-privileged attacker
Command injection in the Comfast CF-N1-S router version 2.6.0.1 allows an authenticated remote attacker to execute arbit
Exploit-DB