A command injection flaw was discovered in the Comfast CF‑N1 V2 router firmware 2.6.0.2. The vulnerability resides in the sub_44AB9C routine of the /cgi‑bin/mbox‑config CGI handler. By supplying a specially crafted value for the channel parameter, an attacker can execute arbitrary operating‑system commands on the router, which can lead to full remote compromise, allowing data exfiltration or pivoting to other internal assets. The flaw is reportable as a remote attack that requires only an ability to reach the router’s management interface over HTTP or HTTPS.

The impact is limited to Comfast CF‑N1 V2 routers running firmware version 2.6.0.2. Earlier firmware releases are not mentioned as affected, and no other manufacturers or products are known to be impacted. Management interfaces that expose the /cgi‑bin/mbox‑config endpoint remain the only affected component.

The CVSS base score is 5.3, indicating moderate severity. The EPSS score is 10 %, suggesting a low current exploitation probability. The vulnerability is publicly available and can be launched remotely. The description states that manipulating the channel argument can lead to arbitrary OS command execution via command injection. Based on the description, it is inferred that authentication may not be required to reach the /cgi-bin/mbox-config endpoint, but this is not explicitly confirmed by the CVE data. The vulnerability is not listed in the CISA KEV catalog, so it has not yet been confirmed as exploited in the wild.