8
CVEs
1
Critical
4
High
0
KEV
7
PoC
5
Unpatched C/H
0.0%
Patch Rate
1.0%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
4
MEDIUM
0
LOW
3
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-77683 | Remote command injection in Comfast CF-N1-S firmware 2.6.0.1 allows a low-privilege authenticated attacker to execute arbitrary OS commands via the NTP timezone configuration CGI endpoint by supplying unsanitized shell metacharacters in the `timestr` parameter. The CVSS 4.0 vector scores 8.6 with full high-impact ratings across confidentiality, integrity, and availability on both the vulnerable device and subsequent systems, reflecting potential for complete device takeover. A public proof-of-concept exploit is available on GitHub, materially lowering the skill threshold for exploitation with no confirmed patch at time of analysis. | HIGH | 8.6 | 1.5% | 65 |
PoC
No patch
|
| CVE-2026-78050 | Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via the NTP timezone configuration CGI endpoint. The vulnerable function sub_41AD7C in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone fails to validate the length of the timestr and ntp_client_enabled parameters before copying them to the stack. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.6 reflects high impact across both the vulnerable device and connected network infrastructure. | HIGH | 8.6 | 0.8% | 64 |
PoC
No patch
|
| CVE-2026-77148 | Stack-based buffer overflow in the Comfast CF-N1-S firmware version 2.6.0.1 allows remote attackers with low-privilege web management credentials to achieve arbitrary code execution on the device. The vulnerable function sub_44B50C, reachable via the CGI endpoint `/cgi-bin/mbox-config?method=SET§ion=ptest_channel`, fails to bounds-check user-supplied input before copying it onto the stack. A public proof-of-concept exploit is available on GitHub (https://github.com/AdminSafe/CVE/issues/7), significantly lowering the barrier to exploitation; no CISA KEV listing has been identified at the time of analysis. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2026-77022 | Stack-based buffer overflow in Comfast CF-N1-S firmware 2.6.0.1 allows authenticated remote attackers to execute arbitrary code by supplying an oversized SSID value to the device's CGI configuration endpoint. The vulnerable function sub_44B438, reachable via /cgi-bin/mbox-config?method=SET§ion=ptest_ssid, performs no bounds checking on the ssid argument before copying it onto the stack. A public proof-of-concept exploit has been released on GitHub, and no vendor patch has been identified at time of analysis. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2026-76008 | Remote unauthenticated stack-based buffer overflow in the Comfast CF-N1-S wireless device (firmware 2.6.0.1) lets attackers corrupt memory by supplying oversized width/height values to the get_para_from_uri routine of the /cgi-bin/mbox-config endpoint. Because the flaw is reachable over the network with no authentication or user interaction (CVSS 4.0 base 10.0), a successful write can crash the device or achieve arbitrary code execution on the embedded firmware. It is not listed in CISA KEV and no productized exploit is confirmed, though a VulDB-referenced GitHub repository (1ChaoRen1/IOT_3) appears to document the finding. | CRITICAL | 10.0 | 0.6% | 51 |
No patch
|
| CVE-2026-19976 | Command injection in COMFAST CF-N1-S firmware 2.6.0.1 allows remote authenticated attackers to execute arbitrary OS commands via the macaddress parameter of the /cgi-bin/mbox-config CGI endpoint. The vulnerable function sub_44A968 fails to sanitize input passed through the ptest_macaddress section before passing it to a system-level command. A public proof-of-concept has been disclosed (GitHub PDF), and the vendor did not respond to responsible disclosure. | LOW | 2.0 | 2.1% | 32 |
PoC
No patch
|
| CVE-2026-77004 | Command injection in the Comfast CF-N1-S firmware 2.6.0.1 CGI management interface allows remote low-privileged attackers to execute arbitrary OS commands by manipulating the 'sn' parameter in the /cgi-bin/mbox-config endpoint. The root cause is unsafe use of sprintf in the CGI handler that incorporates attacker-controlled input directly into a shell command without sanitization or escaping. A public proof-of-concept has been published on GitHub as a PDF document; this is not currently listed in the CISA KEV catalog. | LOW | 2.1 | 1.3% | 32 |
PoC
No patch
|
| CVE-2026-12814 | OS command injection in Comfast CF-WR631AX V3 firmware (versions 2.7.0.0 through 2.7.0.8) allows an authenticated remote attacker to execute arbitrary operating system commands by injecting shell metacharacters into the `destination` parameter of the ping configuration API endpoint at /cgi-bin/mbox-config?section=ping_config. A detailed public exploit analysis report is available on GitHub, materially lowering the exploitation barrier, though no CISA KEV listing confirms active in-the-wild campaigns at time of analysis. The vendor was notified prior to disclosure and did not respond, leaving all known firmware versions without a patch. | LOW | 2.1 | 1.2% | 30 |
PoC
No patch
|