CVE-2026-2534 - Vulnerability Details

- Comfast CF-N1 V2 mbox-config sub_44AC4C command injection

Description

A vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=SET&section=ptest_bandwidth. The manipulation of the argument bandwidth leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-02-16

Score: 5.3 Medium

EPSS: 13.0% Moderate

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the sub_44AC4C routine within the /cgi-bin/mbox-config component of CF‑N1 V2 firmware 2.6.0.2. Malicious manipulation of the bandwidth parameter allows an attacker to inject arbitrary shell commands, giving them the ability to execute code on the device. This is a classic example of command injection, classified under CWE‑74 and CWE‑77. The impact is the compromise of confidentiality, integrity, and availability of the device.

Affected Systems

Affected systems are Comfast CF‑N1 V2 routers running firmware version 2.6.0.2. The vendor is Comfast; the product name is CF‑N1 V2. No other vendors or products are listed as affected.

Risk and Exploitability

5.3, indicating moderate severity. EPSS is 14% and the vulnerability is not listed in the CISA KEV catalog, which indicates a moderate exploitation probability. The likely attack vector is remote; the description does not explicitly state authentication requirements, so it is inferred that the exploit can be launched without prior access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Comfast

CF-N1 V2

affected

Version	Status	Constraints
`2.6.0.2`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:comfast:cf-n1_firmware:2.6.0.2:*:*:*:*:*:*:*

cpe:2.3:h:comfast:cf-n1:2:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Comfast

Cf-n1

—

Version	Status	Scheme	Platform
`2.6.0.2`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the router to a firmware version that eliminates the vulnerable subroutine and disables the bandwidth parameter manipulation; verify the new firmware source against a trusted checksum.
If an immediate firmware upgrade is not possible, block external HTTP access to the /cgi-bin/mbox-config endpoint using a firewall or router ACL, limiting configuration changes to local network devices only.
Apply general input validation on the bandwidth parameter to reject non‑numeric or shell‑special characters, thereby preventing command injection.

Generated by OpenCVE AI on July 21, 2026 at 19:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.13049.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/jinhao118/cve/blob/main/ComFast%20Router_1.md
https://vuldb.com/?ctiid.346122
https://vuldb.com/?id.346122
https://vuldb.com/?submit.748783

History

Thu, 19 Feb 2026 19:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Comfast cf-n1 Firmware
CPEs		cpe:2.3:h:comfast:cf-n1:2:::::::* cpe:2.3:o:comfast:cf-n1_firmware:2.6.0.2:::::::*
Vendors & Products		Comfast cf-n1 Firmware

Tue, 17 Feb 2026 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 17 Feb 2026 09:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Comfast Comfast cf-n1
Vendors & Products		Comfast Comfast cf-n1

Mon, 16 Feb 2026 04:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=SET&section=ptest_bandwidth. The manipulation of the argument bandwidth leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title		Comfast CF-N1 V2 mbox-config sub_44AC4C command injection
Weaknesses		CWE-74 CWE-77
References		https://github.com/jinhao118/cve/blob/main/ComFast%20Router_1.md https://vuldb.com/?ctiid.346122 https://vuldb.com/?id.346122 https://vuldb.com/?submit.748783
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Comfast Cf-n1 Cf-n1 Firmware

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-02-16T04:02:06.616Z

Updated: 2026-02-23T10:05:26.078Z

Reserved: 2026-02-15T09:15:18.220Z

Link: CVE-2026-2534

Vulnrichment

Updated: 2026-02-17T16:34:04.011Z

NVD

Status : Analyzed

Published: 2026-02-16T04:15:52.470

Modified: 2026-06-17T10:31:15.727

Link: CVE-2026-2534

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-21T19:45:03Z

Weaknesses

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object