15
CVEs
1
Critical
5
High
0
KEV
14
PoC
6
Unpatched C/H
0.0%
Patch Rate
0.7%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
5
MEDIUM
0
LOW
9
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-77683 | Remote command injection in Comfast CF-N1-S firmware 2.6.0.1 allows a low-privilege authenticated attacker to execute arbitrary OS commands via the NTP timezone configuration CGI endpoint by supplying unsanitized shell metacharacters in the `timestr` parameter. The CVSS 4.0 vector scores 8.6 with full high-impact ratings across confidentiality, integrity, and availability on both the vulnerable device and subsequent systems, reflecting potential for complete device takeover. A public proof-of-concept exploit is available on GitHub, materially lowering the skill threshold for exploitation with no confirmed patch at time of analysis. | HIGH | 8.6 | 1.5% | 65 |
PoC
No patch
|
| CVE-2025-57293 | A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-78050 | Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via the NTP timezone configuration CGI endpoint. The vulnerable function sub_41AD7C in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone fails to validate the length of the timestr and ntp_client_enabled parameters before copying them to the stack. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.6 reflects high impact across both the vulnerable device and connected network infrastructure. | HIGH | 8.6 | 0.8% | 64 |
PoC
No patch
|
| CVE-2026-77148 | Stack-based buffer overflow in the Comfast CF-N1-S firmware version 2.6.0.1 allows remote attackers with low-privilege web management credentials to achieve arbitrary code execution on the device. The vulnerable function sub_44B50C, reachable via the CGI endpoint `/cgi-bin/mbox-config?method=SET§ion=ptest_channel`, fails to bounds-check user-supplied input before copying it onto the stack. A public proof-of-concept exploit is available on GitHub (https://github.com/AdminSafe/CVE/issues/7), significantly lowering the barrier to exploitation; no CISA KEV listing has been identified at the time of analysis. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2026-77022 | Stack-based buffer overflow in Comfast CF-N1-S firmware 2.6.0.1 allows authenticated remote attackers to execute arbitrary code by supplying an oversized SSID value to the device's CGI configuration endpoint. The vulnerable function sub_44B438, reachable via /cgi-bin/mbox-config?method=SET§ion=ptest_ssid, performs no bounds checking on the ssid argument before copying it onto the stack. A public proof-of-concept exploit has been released on GitHub, and no vendor patch has been identified at time of analysis. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2026-76008 | Remote unauthenticated stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets attackers corrupt memory by supplying oversized width/height values to the get_para_from_uri routine of the /cgi-bin/mbox-config endpoint. Because the flaw is reachable over the network with no authentication or user interaction (CVSS 4.0 base 10.0), a successful write can crash the device or achieve arbitrary code execution on the embedded firmware. It is not listed in CISA KEV and no productized exploit is confirmed, though a VulDB-referenced GitHub repository (1ChaoRen1/IOT_3) appears to document the finding. | CRITICAL | 10.0 | 0.6% | 51 |
No patch
|
| CVE-2026-19976 | Command injection in COMFAST CF-N1-S firmware 2.6.0.1 allows remote authenticated attackers to execute arbitrary OS commands via the macaddress parameter of the /cgi-bin/mbox-config CGI endpoint. The vulnerable function sub_44A968 fails to sanitize input passed through the ptest_macaddress section before passing it to a system-level command. A public proof-of-concept has been disclosed (GitHub PDF), and the vendor did not respond to responsible disclosure. | LOW | 2.0 | 2.1% | 32 |
PoC
No patch
|
| CVE-2026-77004 | Command injection in the Comfast CF-N1-S firmware 2.6.0.1 CGI management interface allows remote low-privileged attackers to execute arbitrary OS commands by manipulating the 'sn' parameter in the /cgi-bin/mbox-config endpoint. The root cause is unsafe use of sprintf in the CGI handler that incorporates attacker-controlled input directly into a shell command without sanitization or escaping. A public proof-of-concept has been published on GitHub as a PDF document; this is not currently listed in the CISA KEV catalog. | LOW | 2.1 | 1.3% | 32 |
PoC
No patch
|
| CVE-2026-6799 | Command injection in the Comfast CF-N1-S router version 2.6.0.1 allows an authenticated remote attacker to execute arbitrary OS commands by manipulating the `destination` parameter of the `/cgi-bin/mbox-config?method=SET§ion=ping_config` CGI endpoint. A public exploit has been released on GitHub. No vendor patch exists - the vendor was contacted prior to disclosure and did not respond. Despite the public POC, EPSS sits at 0.84% and SSVC classifies exploitation as none with partial technical impact, suggesting limited real-world uptake at time of analysis. | LOW | 2.1 | 0.8% | 31 |
PoC
No patch
|
| CVE-2026-2534 | Command injection in Comfast CF-N1 V2 firmware version 2.6.0.2 allows authenticated remote attackers to execute arbitrary commands through the bandwidth parameter in the /cgi-bin/mbox-config endpoint. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor. | LOW | 2.1 | 0.4% | 31 |
PoC
No patch
|
| CVE-2026-2535 | Command injection in Comfast CF-N1 V2 2.6.0.2 firmware allows authenticated remote attackers to execute arbitrary commands via the channel parameter in the /cgi-bin/mbox-config endpoint. Public exploit code exists for this vulnerability, and the vendor has not released a patch despite early notification. An attacker with valid credentials can achieve remote code execution with limited integrity and confidentiality impact. | LOW | 2.1 | 0.4% | 31 |
PoC
No patch
|
| CVE-2026-2823 | Command injection in Comfast CF-E7 firmware versions 2.6.0.9 and earlier allows remote authenticated attackers to execute arbitrary commands through the timestr parameter in the NTP timezone configuration function. Public exploit code exists for this vulnerability, and the vendor has not provided patches despite early notification. An attacker with valid credentials can achieve remote code execution with medium impact on confidentiality, integrity, and availability. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-2824 | Cf-E7 Firmware versions up to 2.6.0.9 contains a vulnerability that allows attackers to command injection (CVSS 6.3). | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-12814 | OS command injection in Comfast CF-WR631AX V3 firmware (versions 2.7.0.0 through 2.7.0.8) allows an authenticated remote attacker to execute arbitrary operating system commands by injecting shell metacharacters into the `destination` parameter of the ping configuration API endpoint at /cgi-bin/mbox-config?section=ping_config. A detailed public exploit analysis report is available on GitHub, materially lowering the exploitation barrier, though no CISA KEV listing confirms active in-the-wild campaigns at time of analysis. The vendor was notified prior to disclosure and did not respond, leaving all known firmware versions without a patch. | LOW | 2.1 | 1.2% | 30 |
PoC
No patch
|
| CVE-2026-2537 | Command injection in Comfast CF-E4 2.6.0.1 firmware allows remote attackers with high privileges to execute arbitrary commands through the timestr parameter in the NTP timezone configuration endpoint. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early disclosure notification. The attack requires network access and high-level authentication but carries a low CVSS score due to limited scope of impact. | LOW | 2.0 | 0.2% | 30 |
PoC
No patch
|