Description
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.
Published: 2026-08-20
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the sprintf call within the mbox-config CGI of Comfast CF-N1-S firmware 2.6.0.1. The function improperly handles the sn argument, allowing an attacker to construct a malicious string that the underlying system executes as a shell command. Remote exploitation therefore can grant the attacker arbitrary command execution on the device, compromising confidentiality, integrity, and availability of the affected network appliance.

Affected Systems

This flaw affects Comfast CF‑N1‑S devices running firmware version 2.6.0.1. No other products or versions are listed in the official CNA data.

Risk and Exploitability

The CVSS score of 5.3 classifies the risk as moderate, yet the vulnerability is exploitable from outside the network and an exploit has already been published. With no EPSS value reported and the vulnerability not listed in the CISA KEV catalog, the likelihood of widespread exploitation is uncertain, but the remote command injection capability demands immediate attention.

Generated by OpenCVE AI on August 20, 2026 at 20:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update from Comfast that addresses the sprintf injection flaw.
  • Configure the device firewall or access control to block or limit remote traffic to the /cgi-bin/mbox-config endpoint.
  • Implement input validation for the sn parameter or restrict its length to eliminate the possibility of accidental command execution.

Generated by OpenCVE AI on August 20, 2026 at 20:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.
Title Comfast CF-N1-S mbox-config sprintf command injection
First Time appeared Comfast
Comfast cf-n1-s
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:comfast:cf-n1-s:*:*:*:*:*:*:*:*
Vendors & Products Comfast
Comfast cf-n1-s
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}

Subscriptions

Comfast Cf-n1-s
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-20T17:10:13.138Z

Reserved: 2026-08-20T07:31:59.383Z

Link: CVE-2026-77004

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-20T16:18:31.580

Modified: 2026-08-20T17:19:48.930

Link: CVE-2026-77004

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T20:45:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')