Description
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely.
Published: 2026-08-19
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a stack-based buffer overflow triggered by parsing the width and height parameters in the get_para_from_uri function of the /cgi-bin/mbox-config URI handler. Maliciously crafted inputs can overflow the stack, giving an attacker the ability to execute arbitrary code on the device. This corresponds to buffer overflow weaknesses (CWE-119) and stack-based overflow (CWE-121). The effect is potentially complete device compromise with full control of the system.

Affected Systems

Affected hardware is the Comfast CF-N1-S device running firmware version 2.6.0.1. The flaw resides in the device’s web interface in the mbox-config CGI component. No other versions or products are currently listed as affected.

Risk and Exploitability

The CVSS score of 10 indicates critical severity. The EPSS score is not available, and the vulnerability is not yet listed in CISA's KEV catalog, but the lack of reported exploitation does not reduce its inherent risk. Since the attack vector is remote via HTTP, an attacker can target the device over a network. Given the high CVSS and the ability to run code on the device, the likelihood of exploitation is high if the device is exposed to untrusted networks. Administrators should treat this as a high‑risk vulnerability until resolved.

Generated by OpenCVE AI on August 19, 2026 at 06:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Securely update the device firmware to a version that includes the get_para_from_uri fix.
  • If no update is available, block external access to the /cgi-bin/mbox-config web interface using a firewall or access control list.
  • Restrict the MBOX configuration functionality to local management traffic or disable it entirely.
  • Apply input validation or rate limiting to URI parameters to reduce risk while a patch is pending.

Generated by OpenCVE AI on August 19, 2026 at 06:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely.
Title Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow
First Time appeared Comfast
Comfast cf-n1-s
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:comfast:cf-n1-s:*:*:*:*:*:*:*:*
Vendors & Products Comfast
Comfast cf-n1-s
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X'}

Subscriptions

Comfast Cf-n1-s
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-19T15:47:03.268Z

Reserved: 2026-08-18T18:53:46.811Z

Link: CVE-2026-76008

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-19T03:16:53.077

Modified: 2026-08-20T12:48:10.287

Link: CVE-2026-76008

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T11:45:04Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow