Description
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
Published: 2026-08-20
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack-based buffer overflow exists in the sub_44B50C function of the Web Management CGI on Comfast CF‑N1‑S devices. The /cgi-bin/mbox-config?method=SET&section=ptest_channel endpoint accepts input that overflows a local buffer, enabling an attacker to corrupt the call stack and execute arbitrary code. This vulnerability can be triggered remotely from any network connected to the device, and a public exploit demonstrating the control‑flow hijack has been released.

Affected Systems

The flaw affects Comfast CF‑N1‑S routers running firmware version 2.6.0.1. No other firmware revisions are stated to be vulnerable in the advisory.

Risk and Exploitability

The CVSS base score of 9.4 reflects a severe risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the presence of a remote attack vector and a publicly available exploit make it highly likely to be targeted. Likely attack will involve sending crafted data to the exposed web endpoint from an external network to trigger the overflow and gain code execution.

Generated by OpenCVE AI on August 21, 2026 at 02:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the CF‑N1‑S firmware to a version that fixes the buffer‑overflow in the Web Management CGI.
  • If no patched firmware is available, block or disable remote access to /cgi-bin/mbox-config or the Web Management interface entirely.
  • Deploy network segmentation and a web‑application firewall rule to drop or rate‑limit anomalous requests to the /cgi-bin/mbox-config endpoint.

Generated by OpenCVE AI on August 21, 2026 at 02:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
Title Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow
First Time appeared Comfast
Comfast cf-n1-s
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:comfast:cf-n1-s:*:*:*:*:*:*:*:*
Vendors & Products Comfast
Comfast cf-n1-s
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Comfast Cf-n1-s
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-20T19:46:50.485Z

Reserved: 2026-08-20T13:49:33.053Z

Link: CVE-2026-77148

cve-icon Vulnrichment

Updated: 2026-08-20T19:46:44.882Z

cve-icon NVD

Status : Deferred

Published: 2026-08-20T19:17:04.710

Modified: 2026-08-24T16:40:53.647

Link: CVE-2026-77148

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T02:45:04Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow