A command injection flaw exists in the /cgi-bin/mbox-config?method=SET&section=ping_config endpoint of Comfast CF‑N1‑S routers. By manipulating the destination argument, an attacker can inject arbitrary shell commands through a remote HTTP interface. The CVE description explicitly states that the exploit is publicly available and can be launched remotely, indicating that the vulnerability can be triggered from outside the local network. Because no authentication requirement is detailed in the description, it is inferred that the command injection does not require prior login or privileged credentials and can be exploited purely via crafted HTTP requests. Successful exploitation would allow an attacker to execute any shell command, thereby achieving remote code execution or persistent compromise of the device.

The vulnerability is confirmed on Comfast CF‑N1‑S firmware version 2.6.0.1. No other variants or firmware revisions are listed as affected in the CVE data.

The CVSS score of 5.3 denotes a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the existence of a public exploit and the inferred lack of authentication requirements means that remote attackers can easily target affected routers. The risk is amplified by the vendor’s lack of response, leaving devices exposed until a patch or workaround is deployed.