Description
A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component webmggnt. Performing a manipulation of the argument timestr results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-02-20
Score: 5.3 Medium
EPSS: 16.8% Moderate
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A command injection flaw exists in the sub_41ACCC function of the webmggnt component of Comfast CF‑E7 routers. The vulnerability is triggered by manipulating the timestr argument of the /cgi-bin/mbox-config?method=SET&section=ntp_timezone endpoint. An attacker can supply crafted input that is passed directly to the underlying shell, allowing arbitrary command execution with the router’s management interface.

Affected Systems

Affected devices are Comfast CF‑E7 routers running firmware 2.6.0.9. The CVE references this specific revision; the vulnerability may exist in other firmware versions, but this is not confirmed.

Risk and Exploitability

The CVSS base score of 5.3 indicates medium severity. The EPSS score of 17% suggests a relatively high likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, but public exploits are available. Attackers can trigger the injection remotely by sending a crafted HTTP request to the router’s externally accessible web interface, targeting the /cgi-bin/mbox-config endpoint.

Generated by OpenCVE AI on July 16, 2026 at 12:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply firewall or DMZ rules to restrict upstream traffic to the router’s web management interface, allowing only trusted internal or VPN addresses to reach the /cgi-bin/mbox-config endpoint.
  • Disable the /cgi-bin/mbox-config endpoint if it is not required, or enforce strict input validation that rejects non‑numeric or overly long timestr values, preventing kernel‑level command execution.
  • Enable detailed HTTP logging on the router and establish monitoring or alerting for attempts to inject payloads or rate‑limit the source IP after repeated failures.
  • Regularly review the vendor’s support pages or contact Comfast for firmware releases that contain a fix, and apply any available patch as soon as it is published.

Generated by OpenCVE AI on July 16, 2026 at 12:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 10:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:comfast:cf-e7_firmware:*:*:*:*:*:*:*:*

Fri, 20 Feb 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Comfast cf-e7 Firmware
CPEs cpe:2.3:h:comfast:cf-e7:-:*:*:*:*:*:*:*
cpe:2.3:o:comfast:cf-e7_firmware:2.6.0.9:*:*:*:*:*:*:*
Vendors & Products Comfast cf-e7 Firmware

Fri, 20 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 20 Feb 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Comfast
Comfast cf-e7
Vendors & Products Comfast
Comfast cf-e7

Fri, 20 Feb 2026 05:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component webmggnt. Performing a manipulation of the argument timestr results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Comfast CF-E7 webmggnt mbox-config sub_41ACCC command injection
Weaknesses CWE-74
CWE-77
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Comfast Cf-e7 Cf-e7 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T10:30:48.632Z

Reserved: 2026-02-19T17:22:19.708Z

Link: CVE-2026-2823

cve-icon Vulnrichment

Updated: 2026-02-20T14:53:10.252Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-20T05:17:53.923

Modified: 2026-06-17T10:31:50.297

Link: CVE-2026-2823

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-16T13:00:14Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')