Description
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component SSID Configuration. The manipulation of the argument ssid results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-08-20
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a stack‑based buffer overflow triggered by an overly long ssid value passed to the sub_44B438 function in the SSID configuration CGI. This flaw allows an attacker to overflow the stack and potentially execute arbitrary code with the privileges of the web service, leading to full compromise of the device. The flaw is listed as CWE‑119 and CWE‑121 and the CVE description states that remote exploitation is possible and public exploits exist.

Affected Systems

Vendors: Comfast. Product: CF‑N1‑S wireless router running firmware version 2.6.0.1. The affected component is the /cgi‑bin/mbox‑config web interface handling SSID settings.

Risk and Exploitability

The CVSS score of 9.4 indicates the vulnerability is critical. The EPSS score is not available but the availability of a public exploit and the remote attack vector raise the likelihood of exploitation. The flaw is not yet listed in the CISA KEV catalog; however, it should be treated as a high‑risk vulnerability that can be leveraged for arbitrary code execution on the device by any external party able to connect to its web interface.

Generated by OpenCVE AI on August 20, 2026 at 20:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the CF‑N1‑S firmware to the latest version that addresses the stack‑buffer overflow in the SSID configuration CGI.
  • If a firmware update is not available immediately, block or restrict external access to the /cgi‑bin/mbox‑config endpoint so that only trusted local devices can reach the web interface.
  • Enable logging for SSID configuration changes and monitor for anomalous activity; consider disabling web‑based SSID modification entirely if it is not required for operation.

Generated by OpenCVE AI on August 20, 2026 at 20:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component SSID Configuration. The manipulation of the argument ssid results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Title Comfast CF-N1-S SSID Configuration mbox-config sub_44B438 stack-based overflow
First Time appeared Comfast
Comfast cf-n1-s
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:comfast:cf-n1-s:*:*:*:*:*:*:*:*
Vendors & Products Comfast
Comfast cf-n1-s
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Comfast Cf-n1-s
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-20T16:45:07.012Z

Reserved: 2026-08-20T08:33:45.881Z

Link: CVE-2026-77022

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-20T17:19:49.413

Modified: 2026-08-20T17:19:49.413

Link: CVE-2026-77022

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T20:30:05Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow