CVE-2026-2534 - Vulnerability Details

- Comfast CF-N1 V2 mbox-config sub_44AC4C command injection

Description

A vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=SET&section=ptest_bandwidth. The manipulation of the argument bandwidth leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-02-16

Score: 5.3 Medium

EPSS: 15.0% Moderate

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the function sub_44AC4C of the file /cgi-bin/mbox-config?method=SET&section=ptest_bandwidth. Manipulation of the bandwidth argument allows an attacker to inject arbitrary shell commands, enabling execution of malicious code on the device. This type of flaw is characterized by CWE-74 and CWE-77. The potential impact includes compromise of confidentiality, integrity, and availability of the router.

Affected Systems

Affected systems are Comfast CF‑N1 V2 routers running firmware version 2.6.0.2. The vendor is Comfast; the product name is CF‑N1 V2. No other vendors or products are listed as affected.

Risk and Exploitability

The CVSS score is 5.3. The EPSS score of 15% indicates a moderate exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be remote, as the exploit can be initiated over the network without prior local access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Comfast

CF-N1 V2

affected

Version	Status	Constraints
`2.6.0.2`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:comfast:cf-n1_firmware:2.6.0.2:*:*:*:*:*:*:*

cpe:2.3:h:comfast:cf-n1:2:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Comfast

Cf-n1

—

Version	Status	Scheme	Platform
`2.6.0.2`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the router to a firmware version that eliminates the vulnerable subroutine and disables the bandwidth parameter manipulation; verify the new firmware source against a trusted not possible, block external HTTP access to the /cgi-bin/mbox-config endpoint using a firewall or router ACL, limiting configuration changes to local network devices only.
Apply general input validation on the bandwidth parameter to reject non‑numeric or shell‑special characters, thereby preventing command injection.
Block remote access to the /cgi-bin/mbox-config endpoint via firewall rules or ACL to prevent exploitation from outside the local network.

Generated by OpenCVE AI on October 17, 2026 at 10:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.1505.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/jinhao118/cve/blob/main/ComFast%20Router_1.md
https://vuldb.com/?ctiid.346122
https://vuldb.com/?id.346122
https://vuldb.com/?submit.748783

History

Thu, 19 Feb 2026 19:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Comfast cf-n1 Firmware
CPEs		cpe:2.3:h:comfast:cf-n1:2:::::::* cpe:2.3:o:comfast:cf-n1_firmware:2.6.0.2:::::::*
Vendors & Products		Comfast cf-n1 Firmware

Tue, 17 Feb 2026 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 17 Feb 2026 09:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Comfast Comfast cf-n1
Vendors & Products		Comfast Comfast cf-n1

Mon, 16 Feb 2026 04:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability has been found in Comfast CF-N1 V2 2.6.0.2. The affected element is the function sub_44AC4C of the file /cgi-bin/mbox-config?method=SET&section=ptest_bandwidth. The manipulation of the argument bandwidth leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title		Comfast CF-N1 V2 mbox-config sub_44AC4C command injection
Weaknesses		CWE-74 CWE-77
References		https://github.com/jinhao118/cve/blob/main/ComFast%20Router_1.md https://vuldb.com/?ctiid.346122 https://vuldb.com/?id.346122 https://vuldb.com/?submit.748783
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Comfast Cf-n1 Cf-n1 Firmware

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-02-16T04:02:06.616Z

Updated: 2026-02-23T10:05:26.078Z

Reserved: 2026-02-15T09:15:18.220Z

Link: CVE-2026-2534

Vulnrichment

Updated: 2026-02-17T16:34:04.011Z

NVD

Status : Analyzed

Published: 2026-02-16T04:15:52.470

Modified: 2026-06-17T10:31:15.727

Link: CVE-2026-2534

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-17T10:30:07Z

Weaknesses

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object