Comfast
Monthly
Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via the NTP timezone configuration CGI endpoint. The vulnerable function sub_41AD7C in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone fails to validate the length of the timestr and ntp_client_enabled parameters before copying them to the stack. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.6 reflects high impact across both the vulnerable device and connected network infrastructure.
Remote command injection in Comfast CF-N1-S firmware 2.6.0.1 allows a low-privilege authenticated attacker to execute arbitrary OS commands via the NTP timezone configuration CGI endpoint by supplying unsanitized shell metacharacters in the `timestr` parameter. The CVSS 4.0 vector scores 8.6 with full high-impact ratings across confidentiality, integrity, and availability on both the vulnerable device and subsequent systems, reflecting potential for complete device takeover. A public proof-of-concept exploit is available on GitHub, materially lowering the skill threshold for exploitation with no confirmed patch at time of analysis.
Stack-based buffer overflow in the Comfast CF-N1-S firmware version 2.6.0.1 allows remote attackers with low-privilege web management credentials to achieve arbitrary code execution on the device. The vulnerable function sub_44B50C, reachable via the CGI endpoint `/cgi-bin/mbox-config?method=SET§ion=ptest_channel`, fails to bounds-check user-supplied input before copying it onto the stack. A public proof-of-concept exploit is available on GitHub (https://github.com/AdminSafe/CVE/issues/7), significantly lowering the barrier to exploitation; no CISA KEV listing has been identified at the time of analysis.
Stack-based buffer overflow in Comfast CF-N1-S firmware 2.6.0.1 allows authenticated remote attackers to execute arbitrary code by supplying an oversized SSID value to the device's CGI configuration endpoint. The vulnerable function sub_44B438, reachable via /cgi-bin/mbox-config?method=SET§ion=ptest_ssid, performs no bounds checking on the ssid argument before copying it onto the stack. A public proof-of-concept exploit has been released on GitHub, and no vendor patch has been identified at time of analysis.
Remote unauthenticated stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets attackers corrupt memory by supplying oversized width/height values to the get_para_from_uri routine of the /cgi-bin/mbox-config endpoint. Because the flaw is reachable over the network with no authentication or user interaction (CVSS 4.0 base 10.0), a successful write can crash the device or achieve arbitrary code execution on the embedded firmware. It is not listed in CISA KEV and no productized exploit is confirmed, though a VulDB-referenced GitHub repository (1ChaoRen1/IOT_3) appears to document the finding.
Command injection in the Comfast CF-N1-S firmware 2.6.0.1 CGI management interface allows remote low-privileged attackers to execute arbitrary OS commands by manipulating the 'sn' parameter in the /cgi-bin/mbox-config endpoint. The root cause is unsafe use of sprintf in the CGI handler that incorporates attacker-controlled input directly into a shell command without sanitization or escaping. A public proof-of-concept has been published on GitHub as a PDF document; this is not currently listed in the CISA KEV catalog.
Command injection in COMFAST CF-N1-S firmware 2.6.0.1 allows remote authenticated attackers to execute arbitrary OS commands via the macaddress parameter of the /cgi-bin/mbox-config CGI endpoint. The vulnerable function sub_44A968 fails to sanitize input passed through the ptest_macaddress section before passing it to a system-level command. A public proof-of-concept has been disclosed (GitHub PDF), and the vendor did not respond to responsible disclosure.
OS command injection in Comfast CF-WR631AX V3 firmware (versions 2.7.0.0 through 2.7.0.8) allows an authenticated remote attacker to execute arbitrary operating system commands by injecting shell metacharacters into the `destination` parameter of the ping configuration API endpoint at /cgi-bin/mbox-config?section=ping_config. A detailed public exploit analysis report is available on GitHub, materially lowering the exploitation barrier, though no CISA KEV listing confirms active in-the-wild campaigns at time of analysis. The vendor was notified prior to disclosure and did not respond, leaving all known firmware versions without a patch.
Command injection in the Comfast CF-N1-S router version 2.6.0.1 allows an authenticated remote attacker to execute arbitrary OS commands by manipulating the `destination` parameter of the `/cgi-bin/mbox-config?method=SET§ion=ping_config` CGI endpoint. A public exploit has been released on GitHub. No vendor patch exists - the vendor was contacted prior to disclosure and did not respond. Despite the public POC, EPSS sits at 0.84% and SSVC classifies exploitation as none with partial technical impact, suggesting limited real-world uptake at time of analysis.
Cf-E7 Firmware versions up to 2.6.0.9 contains a vulnerability that allows attackers to command injection (CVSS 6.3).
Command injection in Comfast CF-E7 firmware versions 2.6.0.9 and earlier allows remote authenticated attackers to execute arbitrary commands through the timestr parameter in the NTP timezone configuration function. Public exploit code exists for this vulnerability, and the vendor has not provided patches despite early notification. An attacker with valid credentials can achieve remote code execution with medium impact on confidentiality, integrity, and availability.
Command injection in Comfast CF-E4 2.6.0.1 firmware allows remote attackers with high privileges to execute arbitrary commands through the timestr parameter in the NTP timezone configuration endpoint. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early disclosure notification. The attack requires network access and high-level authentication but carries a low CVSS score due to limited scope of impact.
Command injection in Comfast CF-N1 V2 2.6.0.2 firmware allows authenticated remote attackers to execute arbitrary commands via the channel parameter in the /cgi-bin/mbox-config endpoint. Public exploit code exists for this vulnerability, and the vendor has not released a patch despite early notification. An attacker with valid credentials can achieve remote code execution with limited integrity and confidentiality impact.
Command injection in Comfast CF-N1 V2 firmware version 2.6.0.2 allows authenticated remote attackers to execute arbitrary commands through the bandwidth parameter in the /cgi-bin/mbox-config endpoint. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor.
A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Comfast CF-N1 2.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Comfast CF-N1 2.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Comfast CF-N1 2.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Comfast CF-N1 2.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Comfast CF-N1 2.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Comfast CF-N1 2.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webmgnt. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub_431F64 function in bin/webmgnt. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the target via an HTTP POST request. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an unauthenticated page to force the server to generate a. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via the NTP timezone configuration CGI endpoint. The vulnerable function sub_41AD7C in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone fails to validate the length of the timestr and ntp_client_enabled parameters before copying them to the stack. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.6 reflects high impact across both the vulnerable device and connected network infrastructure.
Remote command injection in Comfast CF-N1-S firmware 2.6.0.1 allows a low-privilege authenticated attacker to execute arbitrary OS commands via the NTP timezone configuration CGI endpoint by supplying unsanitized shell metacharacters in the `timestr` parameter. The CVSS 4.0 vector scores 8.6 with full high-impact ratings across confidentiality, integrity, and availability on both the vulnerable device and subsequent systems, reflecting potential for complete device takeover. A public proof-of-concept exploit is available on GitHub, materially lowering the skill threshold for exploitation with no confirmed patch at time of analysis.
Stack-based buffer overflow in the Comfast CF-N1-S firmware version 2.6.0.1 allows remote attackers with low-privilege web management credentials to achieve arbitrary code execution on the device. The vulnerable function sub_44B50C, reachable via the CGI endpoint `/cgi-bin/mbox-config?method=SET§ion=ptest_channel`, fails to bounds-check user-supplied input before copying it onto the stack. A public proof-of-concept exploit is available on GitHub (https://github.com/AdminSafe/CVE/issues/7), significantly lowering the barrier to exploitation; no CISA KEV listing has been identified at the time of analysis.
Stack-based buffer overflow in Comfast CF-N1-S firmware 2.6.0.1 allows authenticated remote attackers to execute arbitrary code by supplying an oversized SSID value to the device's CGI configuration endpoint. The vulnerable function sub_44B438, reachable via /cgi-bin/mbox-config?method=SET§ion=ptest_ssid, performs no bounds checking on the ssid argument before copying it onto the stack. A public proof-of-concept exploit has been released on GitHub, and no vendor patch has been identified at time of analysis.
Remote unauthenticated stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets attackers corrupt memory by supplying oversized width/height values to the get_para_from_uri routine of the /cgi-bin/mbox-config endpoint. Because the flaw is reachable over the network with no authentication or user interaction (CVSS 4.0 base 10.0), a successful write can crash the device or achieve arbitrary code execution on the embedded firmware. It is not listed in CISA KEV and no productized exploit is confirmed, though a VulDB-referenced GitHub repository (1ChaoRen1/IOT_3) appears to document the finding.
Command injection in the Comfast CF-N1-S firmware 2.6.0.1 CGI management interface allows remote low-privileged attackers to execute arbitrary OS commands by manipulating the 'sn' parameter in the /cgi-bin/mbox-config endpoint. The root cause is unsafe use of sprintf in the CGI handler that incorporates attacker-controlled input directly into a shell command without sanitization or escaping. A public proof-of-concept has been published on GitHub as a PDF document; this is not currently listed in the CISA KEV catalog.
Command injection in COMFAST CF-N1-S firmware 2.6.0.1 allows remote authenticated attackers to execute arbitrary OS commands via the macaddress parameter of the /cgi-bin/mbox-config CGI endpoint. The vulnerable function sub_44A968 fails to sanitize input passed through the ptest_macaddress section before passing it to a system-level command. A public proof-of-concept has been disclosed (GitHub PDF), and the vendor did not respond to responsible disclosure.
OS command injection in Comfast CF-WR631AX V3 firmware (versions 2.7.0.0 through 2.7.0.8) allows an authenticated remote attacker to execute arbitrary operating system commands by injecting shell metacharacters into the `destination` parameter of the ping configuration API endpoint at /cgi-bin/mbox-config?section=ping_config. A detailed public exploit analysis report is available on GitHub, materially lowering the exploitation barrier, though no CISA KEV listing confirms active in-the-wild campaigns at time of analysis. The vendor was notified prior to disclosure and did not respond, leaving all known firmware versions without a patch.
Command injection in the Comfast CF-N1-S router version 2.6.0.1 allows an authenticated remote attacker to execute arbitrary OS commands by manipulating the `destination` parameter of the `/cgi-bin/mbox-config?method=SET§ion=ping_config` CGI endpoint. A public exploit has been released on GitHub. No vendor patch exists - the vendor was contacted prior to disclosure and did not respond. Despite the public POC, EPSS sits at 0.84% and SSVC classifies exploitation as none with partial technical impact, suggesting limited real-world uptake at time of analysis.
Cf-E7 Firmware versions up to 2.6.0.9 contains a vulnerability that allows attackers to command injection (CVSS 6.3).
Command injection in Comfast CF-E7 firmware versions 2.6.0.9 and earlier allows remote authenticated attackers to execute arbitrary commands through the timestr parameter in the NTP timezone configuration function. Public exploit code exists for this vulnerability, and the vendor has not provided patches despite early notification. An attacker with valid credentials can achieve remote code execution with medium impact on confidentiality, integrity, and availability.
Command injection in Comfast CF-E4 2.6.0.1 firmware allows remote attackers with high privileges to execute arbitrary commands through the timestr parameter in the NTP timezone configuration endpoint. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early disclosure notification. The attack requires network access and high-level authentication but carries a low CVSS score due to limited scope of impact.
Command injection in Comfast CF-N1 V2 2.6.0.2 firmware allows authenticated remote attackers to execute arbitrary commands via the channel parameter in the /cgi-bin/mbox-config endpoint. Public exploit code exists for this vulnerability, and the vendor has not released a patch despite early notification. An attacker with valid credentials can achieve remote code execution with limited integrity and confidentiality impact.
Command injection in Comfast CF-N1 V2 firmware version 2.6.0.2 allows authenticated remote attackers to execute arbitrary commands through the bandwidth parameter in the /cgi-bin/mbox-config endpoint. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor.
A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Comfast CF-N1 2.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Comfast CF-N1 2.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Comfast CF-N1 2.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Comfast CF-N1 2.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Comfast CF-N1 2.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Comfast CF-N1 2.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webmgnt. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub_431F64 function in bin/webmgnt. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the target via an HTTP POST request. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an unauthenticated page to force the server to generate a. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.