29
CVEs
7
Critical
6
High
0
KEV
28
PoC
13
Unpatched C/H
0.0%
Patch Rate
1.4%
Avg EPSS
Severity Breakdown
CRITICAL
7
HIGH
6
MEDIUM
1
LOW
15
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2022-45725 | Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the target via an HTTP POST request. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 8.8% | 73 |
PoC
No patch
|
| CVE-2023-38862 | An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub_431F64 function in bin/webmgnt. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.1% | 69 |
PoC
No patch
|
| CVE-2023-38863 | An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function at bin/webmgnt. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.1% | 69 |
PoC
No patch
|
| CVE-2023-38865 | COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 2.1% | 69 |
PoC
No patch
|
| CVE-2023-38864 | An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webmgnt. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.1% | 69 |
PoC
No patch
|
| CVE-2023-38866 | COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 2.1% | 69 |
PoC
No patch
|
| CVE-2024-44466 | COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 10.7% | 69 |
PoC
No patch
|
| CVE-2026-77683 | Remote command injection in Comfast CF-N1-S firmware 2.6.0.1 allows a low-privilege authenticated attacker to execute arbitrary OS commands via the NTP timezone configuration CGI endpoint by supplying unsanitized shell metacharacters in the `timestr` parameter. The CVSS 4.0 vector scores 8.6 with full high-impact ratings across confidentiality, integrity, and availability on both the vulnerable device and subsequent systems, reflecting potential for complete device takeover. A public proof-of-concept exploit is available on GitHub, materially lowering the skill threshold for exploitation with no confirmed patch at time of analysis. | HIGH | 8.6 | 1.5% | 65 |
PoC
No patch
|
| CVE-2025-57293 | A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-78050 | Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via the NTP timezone configuration CGI endpoint. The vulnerable function sub_41AD7C in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone fails to validate the length of the timestr and ntp_client_enabled parameters before copying them to the stack. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.6 reflects high impact across both the vulnerable device and connected network infrastructure. | HIGH | 8.6 | 0.8% | 64 |
PoC
No patch
|
| CVE-2026-77148 | Stack-based buffer overflow in the Comfast CF-N1-S firmware version 2.6.0.1 allows remote attackers with low-privilege web management credentials to achieve arbitrary code execution on the device. The vulnerable function sub_44B50C, reachable via the CGI endpoint `/cgi-bin/mbox-config?method=SET§ion=ptest_channel`, fails to bounds-check user-supplied input before copying it onto the stack. A public proof-of-concept exploit is available on GitHub (https://github.com/AdminSafe/CVE/issues/7), significantly lowering the barrier to exploitation; no CISA KEV listing has been identified at the time of analysis. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2026-77022 | Stack-based buffer overflow in Comfast CF-N1-S firmware 2.6.0.1 allows authenticated remote attackers to execute arbitrary code by supplying an oversized SSID value to the device's CGI configuration endpoint. The vulnerable function sub_44B438, reachable via /cgi-bin/mbox-config?method=SET§ion=ptest_ssid, performs no bounds checking on the ssid argument before copying it onto the stack. A public proof-of-concept exploit has been released on GitHub, and no vendor patch has been identified at time of analysis. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2026-76008 | Remote unauthenticated stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets attackers corrupt memory by supplying oversized width/height values to the get_para_from_uri routine of the /cgi-bin/mbox-config endpoint. Because the flaw is reachable over the network with no authentication or user interaction (CVSS 4.0 base 10.0), a successful write can crash the device or achieve arbitrary code execution on the embedded firmware. It is not listed in CISA KEV and no productized exploit is confirmed, though a VulDB-referenced GitHub repository (1ChaoRen1/IOT_3) appears to document the finding. | CRITICAL | 10.0 | 0.6% | 51 |
No patch
|
| CVE-2022-45724 | Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an unauthenticated page to force the server to generate a. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.4 | 0.7% | 48 |
PoC
No patch
|
| CVE-2026-19976 | Command injection in COMFAST CF-N1-S firmware 2.6.0.1 allows remote authenticated attackers to execute arbitrary OS commands via the macaddress parameter of the /cgi-bin/mbox-config CGI endpoint. The vulnerable function sub_44A968 fails to sanitize input passed through the ptest_macaddress section before passing it to a system-level command. A public proof-of-concept has been disclosed (GitHub PDF), and the vendor did not respond to responsible disclosure. | LOW | 2.0 | 2.1% | 32 |
PoC
No patch
|